SAA-C03 Question 28
Single answerA company is building a multi-tier application on AWS. The application uses an Amazon RDS database in the backend and EC2 instances for the application tier. The company wants to ensure that only the EC2 instances in the application tier can access the RDS database, following the principle of least privilege. How should the company configure access to the RDS database?
- A
Assign an IAM role to the EC2 instances that grants access to the RDS database.
- B
Place the EC2 instances and RDS database in the same security group.
- C
Configure an RDS security group to allow inbound traffic only from the EC2 instances' security group.
- D
Enable public access on the RDS database and restrict access using the database username and password.
Show answer and explanation
Correct answer: C
Explanation
To follow the principle of least privilege, access to the RDS database should be restricted to the EC2 instances that need it. Configuring the RDS security group to allow inbound traffic only from the EC2 instances' security group ensures that only the application tier can connect to the database. This approach minimizes the attack surface and ensures secure communication between the application and database tiers.
- A. Incorrect.
Incorrect. IAM roles control permissions for AWS services, but they do not directly control network access to an RDS database.
- B. Incorrect.
Incorrect. While security groups can control access, placing resources in the same security group does not automatically allow communication and may not align with the principle of least privilege.
- C. Correct.
Correct. Configuring the RDS security group to allow inbound traffic only from the EC2 instances' security group ensures that only the application tier instances can access the database, adhering to the principle of least privilege.
- D. Incorrect.
Incorrect. Enabling public access on the RDS database exposes it to the internet, which is a security risk and violates AWS security best practices.