A health-tech startup hosts its patient record database on Amazon EC2 instances inside a private subnet of a Virtual Private Cloud (VPC). The security team needs to restrict incoming database traffic to only the application server instances. Additionally, any outbound response traffic from the database back to the application servers must be allowed automatically, without configuring an explicit outbound rule. Which AWS firewall option should the security team configure to meet these requirements?
- ANetwork Access Control Lists (NACLs) at the subnet level, because they are stateful and automatically allow response traffic to pass through.
- BAWS Shield at the infrastructure level, because AWS manages firewall rules automatically for database ports under the Shared Responsibility Model.
- Security Groups at the instance level, because they are stateful and automatically allow outbound responses to allowed inbound requests.Answer
- DNetwork Access Control Lists (NACLs) at the instance level, because they are stateless and require rules for both inbound and outbound traffic.
Answer
Security Groups at the instance level, because they are stateful and automatically allow outbound responses to allowed inbound requests.
The correct option is the one specifying Security Groups at the instance level. Security Groups are stateful, meaning any inbound traffic allowed is automatically permitted to flow outbound as a response, meeting the requirement to allow return traffic without an explicit outbound rule. They also operate at the instance level, allowing granular access control between specific application and database instances.
Step-by-Step Solution
Key Concept
Stateful instance-level security (Security Groups) vs. stateless subnet-level security (Network ACLs)