Question

A company runs a fleet of EC2 instances in a private subnet that must only initiate outbound HTTPS connections to a specific partner's API at the IP range 203.0.113.0/24. A security review reveals the instances' security group currently allows all outbound traffic (0.0.0.0/0 on all ports). The security engineer must enforce least-privilege egress while ensuring return traffic from the partner API is still permitted. Which change satisfies these requirements with the least operational overhead?

Accepted Answer

Replace the default outbound rule with a single egress rule allowing TCP port 443 to destination 203.0.113.0/24, and rely on the security group's stateful behavior to permit return traffic.

Answer

Keep the outbound rule as 0.0.0.0/0 but add an inbound rule allowing only TCP port 443 from 203.0.113.0/24 so return traffic is explicitly matched.

Answer

Add a network ACL entry allowing outbound TCP 443 to 203.0.113.0/24 and an inbound ephemeral port range rule, leaving the security group unchanged.

Answer

Replace the outbound rule with TCP port 443 to 203.0.113.0/24 and also add an outbound rule for ephemeral ports 1024-65535 to 203.0.113.0/24 to allow responses back.