Close public SSH with SSM

intermediate

Scenario & brief

Operators currently SSH to the app servers over port 22 open to 0.0.0.0/0, and the instances sit in a public subnet. That's a standing invitation to brute-force attacks.

By the end, admin access must no longer depend on an open inbound port: the app tier shouldn't be reachable from the internet directly, egress still needs to work for routine agent and package traffic, and the load balancer stays the one thing the public can reach.

1,500 rps peakp99 ≤ 200ms99.9% availdurability: standardbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met33

Requirements

Load balancer stays public — internet-facing (need internet-facing)
App servers in a private subnet — public subnet (need private subnet)
No public SSH — use SSM or a bastion — public SSH open (need no public SSH)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

App servers in a private subnet: Move it to the private subnet.
No public SSH — use SSM or a bastion: Close public SSH — use SSM Session Manager or a bastion host instead.
Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.