Opening Scenario
Your production environment runs in a VPC. Your RDS database is accessible — and a security audit reveals it has a publicly routable IP. Your Redis cluster is reachable from the public internet. An EC2 instance's security group allows all inbound traffic on all ports (0.0.0.0/0). Nothing has been breached yet, but you've been lucky. How should this environment actually be structured?
Question Progression
1. Should your database be accessible from the internet at all?
Question: Your RDS database only needs to accept connections from your application servers. Why would it ever need to be accessible from the internet?
Reasoning: It doesn't. A database that's reachable from the public internet is exposed to the entire internet — port scanners, brute-force attacks, and any vulnerability in the database engine become a global risk. The application servers are the only legitimate source of database connections.
Answer: Place databases…
In the full tutorial
- VPC Security Layers Summary
- When to Reach for These Controls