A solutions architect is configuring the network security for a two-tier application in a new Amazon VPC. The application consists of web servers deployed in a public subnet and a MySQL database cluster deployed in a private subnet. The web servers must be accessible from the internet, and the database cluster must only accept connections from the web servers. Which TWO configurations should the solutions architect implement to secure these tiers? (Select TWO.)
- Configure the database security group to allow inbound traffic on TCP port 3306 with the source set as the web server security group.Answer
- Configure the web server security group to allow inbound traffic on TCP port 443 from any source (0.0.0.0/0).Answer
- CConfigure the database network ACL to allow inbound database traffic on TCP port 3306, relying on its stateful nature to permit the return traffic automatically.
- DAdd an outbound rule to the database security group that explicitly allows TCP port 3306 response traffic back to the web server security group.
- EAssociate the web server security group directly with the database subnet to permit traffic between the subnets.
Answer
To secure the two-tier application, the database security group should allow inbound database traffic on TCP port 3306 from the web server security group, and the web server security group must allow inbound HTTPS traffic from any source.
Allowing database traffic from the web server security group ensures database access is limited to the web tier. Allowing HTTPS traffic from any source allows public clients to access the web tier. Both configurations use stateful security groups to properly manage access at the instance level.
Step-by-Step Solution
Key Concept
Configuring stateful security groups using security group references as sources or destinations to implement a secure multi-tier architecture.