A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)
Trap 1: Launch the database instance in a public subnet.
Public subnets are internet-facing; database should be in private subnet.
Trap 2: Store database credentials in AWS Systems Manager Parameter Store.
This is a best practice but does not address network security.
- A
Launch the database instance in a public subnet.
Why wrong: Public subnets are internet-facing; database should be in private subnet.
- B
Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.
Security group rules restrict traffic to only the web tier.
- C
Store database credentials in AWS Systems Manager Parameter Store.
Why wrong: This is a best practice but does not address network security.
- D
Launch the web tier instances in a private subnet.
Private subnets have no direct internet access, enhancing security.
- E
Set the 'Publicly accessible' option of the RDS instance to 'No'.
This ensures no public IP is assigned to the database.