SCS-C02 Question 183
Select 2An organization is hosting a web application on Amazon EC2 instances within a public subnet in a VPC. The application needs to interact with a database hosted on Amazon RDS in a private subnet for data storage. The security team has mandated that the EC2 instances should not be able to access the database unless the traffic is explicitly allowed. How can this requirement be enforced?
- A
Use a security group on the Amazon RDS database to allow inbound traffic only from the security group associated with the EC2 instances.
- B
Create a network ACL that allows inbound traffic from the EC2 subnet to the RDS subnet on the database port and deny all other traffic.
- C
Use an IAM policy to explicitly allow the EC2 instances to access the RDS database.
- D
Remove the default route to the internet gateway from the private subnet hosting the RDS database.
- E
Add a rule in the security group of the EC2 instances to allow outbound traffic to the RDS database on the required port.
Show answer and explanation
Correct answers: A, E
Explanation
To enforce the requirement, you need to control network traffic between the EC2 instances and the RDS database. Using security groups is the most effective way to implement this control because they allow resource-specific, stateful traffic rules. By configuring the RDS security group to allow inbound traffic only from the EC2 security group, and ensuring the EC2 security group allows outbound traffic to the RDS database, you satisfy the security team's requirement.
- A. Correct.
This is correct. Security groups are stateful and allow you to specifically control traffic to and from resources. By associating the RDS security group with the EC2 security group, you ensure that only traffic from the EC2 instances is allowed to reach the database.
- B. Incorrect.
This is incorrect. While network ACLs can control traffic, they are stateless and not as granular as security groups. ACLs are typically used for broader subnet-level traffic filtering rather than resource-specific controls.
- C. Incorrect.
This is incorrect. IAM policies control access to AWS resources but do not directly manage network traffic. They cannot enforce network-layer restrictions between EC2 and RDS.
- D. Incorrect.
This is incorrect. Removing the internet gateway route would not restrict access from the EC2 instances to the RDS database, as they are within the same VPC and private subnet.
- E. Correct.
This is correct. Adding an outbound rule to the EC2 instance security group ensures that the instances can communicate with the RDS database on the specified port, such as port 3306 for MySQL.