A production security group is reviewed before launch — find and fix the exposure.
Before launch you are handed the security group rule set for an application server. Only HTTP and HTTPS are meant to be public. Administrative access goes through a bastion in a separate subnet, the database lives in a private subnet, and company policy requires outbound traffic to be restricted.
ingress:
- { port: 22, source: 0.0.0.0/0, note: "ssh for the ops team" }
- { port: 3389, source: 0.0.0.0/0, note: "rdp, windows build agent" }
- { port: 5432, source: 0.0.0.0/0, note: "postgres, used by reports" }
- { port: 80, source: 0.0.0.0/0 }
- { port: 443, source: 0.0.0.0/0 }
egress:
- { port: all, destination: 0.0.0.0/0 }Find the dangerous rules and propose a corrected rule set.
Three rules face the whole internet that must not: management ports 22 and 3389, plus the database on 5432. Restrict administrative access to the bastion subnet, let only the application security group reach the database, keep 80 and 443 public, and replace the open egress with default-deny.
- ✗Treating a non-standard port as protection for an internet-facing service
- ✗Leaving management ports public because the accounts have strong passwords
- ✗Ignoring unrestricted egress as if it carried no risk
- →Why is a source security group a better rule source than an address range?
- →What would default-deny egress have to allow for this host to still work?
Three rules are dangerous: 22 and 3389 expose management to the whole internet, and 5432 publishes the database. A non-standard port is not a control here — the rule's source is. The open egress rule completes the picture: a compromised host can reach any destination.
Restrict administrative access to the bastion subnet, let only the application security group reach the database, keep just 80 and 443 public, and switch egress to default-deny with narrow, explicit allowances.
ingress:
- { port: 22, source: sg-bastion, note: "admin via bastion only" }
- { port: 5432, source: sg-app, note: "db reachable from app tier only" }
- { port: 80, source: 0.0.0.0/0 }
- { port: 443, source: 0.0.0.0/0 }
egress:
- { port: 443, destination: sg-db-endpoint }
- { port: 443, destination: proxy-allowlist }Rule 3389 is removed outright: the Windows build agent does not belong on this server and should live in its own group. Every denied flow should be logged — an attempt to leave the allowed set becomes a detection signal.
