A company is deploying a new application in a new AWS account. A VPC and subnets have been created for the application. The application VPC has been peered with an existing VPC in another account in the same AWS Region to access databases. Amazon EC2 instances will be regularly created and terminated in the application VPC, but only some will require database access in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances requiring database access can reach the databases through the network.
How should the security engineer implement this solution?
A Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access. B Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access. C Create a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPAttach the application security group to the application instances that need database access and attach the database security group to the database instances. D Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access. Show Answer Answer Explanation A security group rule in a same-Region peered VPC can reference a security group in the peer VPC, including one owned by another AWS account. Allowing TCP port 1521 inbound on the database security group from an application security group restricts access to only the instances associated with that application group, so newly created instances receive access only when explicitly assigned the group. Security groups are stateful, so return traffic is automatically allowed. Update your security groups to reference peer security groups
Learn more
Community Discussion