Question

A company runs a three-tier application in a single VPC. The web tier (behind an internet-facing ALB) must reach the app tier on TCP 8080, and the app tier must reach the database tier on TCP 5432. Instances scale in and out frequently via Auto Scaling, so their IP addresses change constantly. The security team wants the tightest possible network controls that do not require manual updates as instances are added or removed. How should the security groups be configured?

Accepted Answer

In the app-tier security group, allow inbound TCP 8080 from the web-tier security group ID; in the database-tier security group, allow inbound TCP 5432 from the app-tier security group ID.

Answer

Allow inbound TCP 8080 and 5432 from the VPC CIDR block in each tier's security group so all instances can communicate regardless of scaling.

Answer

Use NACLs on each subnet to allow the specific ports and dynamically update the NACL rules with a Lambda function whenever Auto Scaling launches an instance.

Answer

Allow inbound TCP 8080 and 5432 from a maintained list of current instance private IP addresses, refreshed by a scheduled automation job.