An enterprise is building an internal human resources application on AWS. The application consists of a front-end server tier and a backend payroll database. The solutions architect needs to isolate the payroll database so that it has no direct route to or from the public internet, and it must only accept incoming traffic on port from the front-end servers.
Which of the following configurations should the solutions architect implement to achieve this security posture? (Select TWO.)
- Associate the payroll database instances with private subnets that do not contain a route to an Internet Gateway in their route tables.Answer
- Add a rule to the payroll database security group that allows inbound traffic on port from the security group of the front-end servers.Answer
- CAdd an outbound rule to the database security group that explicitly denies all traffic to .
- DConfigure a Network ACL on the database subnet that allows inbound traffic on port but has no outbound rules, relying on the stateful response tracking of the subnet boundary.
- EAssociate an AWS WAF Web ACL directly with the database subnet to inspect and filter incoming SQL traffic.
Answer
To secure the payroll database, place the database instances in private subnets that do not route to an Internet Gateway, and configure the database security group to allow inbound traffic on port from the front-end server security group.
Placing the database in private subnets with no route to an Internet Gateway blocks all direct internet access. Configuring the database security group to reference the front-end server security group ensures that only the web tier can connect to the database on the database port, implementing secure least-privilege access.
Step-by-Step Solution
Key Concept
VPC Network Security Isolation using Private Subnets and Stateful Security Group Rules