Stop the public exposure

beginner

Scenario & brief

A quick audit found three of the most common cloud exposures at once: a publicly reachable database, an S3 bucket open to the internet, and SSH open to 0.0.0.0/0 on the app servers.

By the end, none of the three should be exposed: the database unreachable from the internet, the S3 bucket not public, and admin access to the app servers not relying on an open inbound SSH port. The load balancer is the one thing that should stay public.

1,000 rps peakp99 ≤ 200ms99.9% availdurability: standardbudget $200/mo

Load Balancer

Networking

Subnet placement

Allowed ingress (security group)

System health

Erupting · SLA breach

/ 100

Score

SLA not met yet

Monthly cost

$22

Budget $200/mo · within budget

Metrics

Security posture0

Connectivity50

Requirements met20

Requirements

Load balancer stays public — internet-facing (need internet-facing)
Database in a private subnet — public subnet (need private subnet)
Database not reachable from the internet — internet-reachable (need not internet-reachable)
S3 bucket is not public — internet-reachable (need not internet-reachable)
No public SSH on the app servers — public SSH open (need no public SSH)

Advisor

Database in a private subnet: Move it to the private subnet.
Database not reachable from the internet: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
S3 bucket is not public: Put it in a private subnet, drop the public IP, and don't allow ingress from the internet.
No public SSH on the app servers: Close public SSH — use SSM Session Manager or a bastion host instead.

Discussion

No comments yet. Be the first to start the discussion.

For learning purposes only. Costs and capacities are illustrative, not live AWS prices. Not affiliated with or endorsed by Amazon Web Services.