DEA-C01 Question 426
Select 2You are designing a data processing application on AWS that will store sensitive data in an Amazon RDS database. The application will be hosted on Amazon EC2 instances within a VPC. To meet security requirements, you must ensure the EC2 instances can only access the RDS database within the same VPC and prevent any external access to the database. Which combination of actions should you take?
- A
Place the EC2 instances and RDS database in the same subnet and use a security group to control access.
- B
Assign a security group to the RDS instance and configure it to allow traffic only from the security group associated with the EC2 instances.
- C
Create a NAT Gateway in the public subnet to allow the EC2 instances to access the RDS database securely.
- D
Ensure the RDS instance is deployed in a private subnet with no public IP address assigned.
- E
Use a Network ACL to explicitly deny all inbound traffic to the RDS subnet from external IP ranges.
Show answer and explanation
Correct answers: B, D
Explanation
To secure communication between EC2 instances and an RDS database within the same VPC, it is crucial to use security groups to explicitly allow access between these resources while denying external access. Additionally, deploying the RDS database in a private subnet with no public IP address ensures it cannot be accessed from outside the VPC. These measures together meet the security requirements of the scenario.
- A. Incorrect.
Incorrect. While placing resources in the same subnet can simplify networking, it does not inherently restrict access. Security groups are more precise and flexible for controlling access.
- B. Correct.
Correct. Assigning a security group to the RDS instance and configuring it to allow traffic only from the EC2 instance's security group ensures that only the EC2 instances can communicate with the database.
- C. Incorrect.
Incorrect. A NAT Gateway is used to allow resources in private subnets to access external services, such as the internet. It is not necessary for EC2-to-RDS communication within the same VPC.
- D. Correct.
Correct. Deploying the RDS instance in a private subnet with no public IP ensures it is not accessible from outside the VPC, fulfilling the security requirement.
- E. Incorrect.
Incorrect. While Network ACLs can be used for coarse-grained access control, security groups are a better choice for managing access between EC2 and RDS instances. Network ACLs are stateless and less flexible.