Question

A company runs a three-tier web application in a VPC. Application servers run on EC2 instances in a private subnet, and they must connect to an Amazon RDS for PostgreSQL instance in a separate private subnet on port 5432. The security team requires that database access be restricted to only the application servers, and the solution must continue to work automatically as the Auto Scaling group adds or removes EC2 instances. Which configuration meets these requirements?

Accepted Answer

Configure the RDS security group inbound rule to allow port 5432 with a source of the application servers' security group ID.

Answer

Configure the RDS security group inbound rule to allow port 5432 from the CIDR block of the application subnet.

Answer

Add a network ACL rule on the database subnet allowing port 5432 from the current list of EC2 instance private IP addresses.

Answer

Configure the RDS security group inbound rule to allow port 5432 from 0.0.0.0/0 and rely on the private subnet for isolation.