Question

A cloud engineer is deploying a three-tier application. The web tier must accept HTTPS traffic from the internet, the application tier must only accept traffic from the web tier, and the database tier must only accept traffic from the application tier on port 5432. The engineer wants to enforce these controls at the instance-group level using stateful rules as part of the deployment. Which approach best implements this segmentation?

Accepted Answer

Assign each tier its own security group and reference the source tier's security group ID as the allowed source in the next tier's inbound rules

Answer

Place all three tiers in a single security group and rely on a network ACL to filter traffic between subnets

Answer

Assign a single security group to all tiers with an inbound rule allowing 0.0.0.0/0 on ports 443 and 5432

Answer

Use static routes in the route table to prevent the internet from reaching the database tier directly