Question

A company runs a three-tier application in a single VPC. The web tier is an Auto Scaling group behind an internet-facing ALB, the application tier is an Auto Scaling group of EC2 instances, and the database tier is Amazon RDS. Instances scale frequently, so their private IP addresses change constantly. The security team wants the application tier to accept traffic only from the web tier, and the database tier to accept traffic only from the application tier, without maintaining CIDR-based rules that break when instances are replaced. What is the MOST maintainable way to configure the security groups?

Accepted Answer

In the application tier security group, add an inbound rule that references the web tier security group as the source, and in the database tier security group, add an inbound rule that references the application tier security group as the source.

Answer

Configure network ACLs on each tier's subnet to allow inbound traffic from the CIDR range of the tier above it, and update the ranges whenever the subnets change.

Answer

Create a shared security group attached to all three tiers that allows all internal VPC traffic, and rely on host-based firewalls to segment the tiers.

Answer

Assign Elastic IP addresses to every instance and reference those specific IPs as sources in each tier's inbound security group rules.