Question

A company is deploying a three-tier application (web, app, database) in a public cloud IaaS environment. Security requires that the database tier only accept inbound traffic from the app tier, and the app tier only from the web tier, regardless of IP address changes as instances autoscale. The team wants a policy model that references logical workload groupings rather than static IPs. Which approach best meets these requirements?

Accepted Answer

Configure security group rules that reference other security groups (group-based source references) for each tier's allowed inbound traffic

Answer

Assign static private IP addresses to every instance and write ACL rules based on those fixed IPs

Answer

Place all three tiers in a single subnet and rely on host-based firewalls with hardcoded CIDR blocks

Answer

Use a single permissive security group for the whole VPC and inspect traffic only at the internet gateway