SAP-C02 Question 187
Select 1A company runs a multi-tier web application in AWS. The application consists of an Amazon RDS database in a private subnet, an Auto Scaling group of Amazon EC2 instances in a public subnet, and an Application Load Balancer (ALB). The EC2 instances must securely communicate with the RDS database, and the database must not be accessible from the internet. The company wants to ensure that only traffic from the EC2 instances can reach the database while following best practices for security. How should you configure the solution?
- A
Create a security group for the RDS database and allow inbound traffic only from the security group attached to the EC2 instances.
- B
Attach the same security group to both the RDS database and the EC2 instances.
- C
Create a network ACL for the private subnet to allow traffic only from the public subnet.
- D
Use the database default port (3306) and allow inbound access from the public subnet's CIDR range in the RDS security group.
- E
Configure the ALB to forward traffic directly to the RDS database to reduce latency.
Show answer and explanation
Correct answer: A
Explanation
The correct solution is to use security groups to control access between the EC2 instances and the RDS database. By referencing the EC2 instances' security group in the RDS database's security group, you ensure that only traffic originating from the instances is allowed. This approach adheres to AWS security best practices by maintaining least privilege access and ensuring that the database is not exposed to unnecessary traffic.
- A. Correct.
Correct: This follows the principle of security group referencing. By allowing traffic only from the EC2 instances' security group, you ensure that only those instances can communicate with the database securely.
- B. Incorrect.
Incorrect: While it is possible to attach the same security group to both resources, it is not a best practice. This approach could unintentionally allow traffic to flow in unintended directions.
- C. Incorrect.
Incorrect: Network ACLs operate at the subnet level but are not stateful. Security groups are the correct tool to use for this scenario because they are stateful and allow granular control over instance-to-instance communication.
- D. Incorrect.
Incorrect: Allowing access from the public subnet's CIDR range is not secure. It opens up access to the database unnecessarily, violating best practices.
- E. Incorrect.
Incorrect: ALBs are designed to distribute traffic to EC2 instances or other targets, not directly to databases. This approach is not supported and does not align with the architecture described.