Lock down the database

intermediate

Scenario & brief

A security review flagged the database: it's in a public subnet, its security group allows ingress from the internet, and it has no encryption at rest or in transit.

By the end, the database must be unreachable from the internet and accept traffic only from the app tier, with encryption on at rest and in transit. The app tier stays private too, with the ALB as the only public entry point and NAT still providing egress.

1,000 rps peakp99 ≤ 200ms99.9% availdurability: criticalbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met25

Requirements

Load balancer is internet-facing — internet-facing (need internet-facing)
App servers in a private subnet — private subnet (need private subnet)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
Database accepts traffic only from the app tier — from internet (need only from app)
Database encrypted at rest — plaintext (need encrypted at rest)
Database traffic encrypted in transit — cleartext (need encrypted in transit)
Private subnets egress via NAT — no NAT (need private egress via NAT)

Advisor

Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
Database accepts traffic only from the app tier: Restrict the security group to accept traffic only from app.
Database encrypted at rest: Enable encryption at rest.
Database traffic encrypted in transit: Require TLS/HTTPS in transit.
Private subnets egress via NAT: Add a NAT gateway so private-subnet resources can reach the internet for updates without being exposed.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.