Geek Answers Handbook

Protect outbound rules from EC2 instances using ECS

Even when I create EC2 instances on a private subnet, they should be able to send traffic to the Internet if I want to register them in an ECS cluster.

I use a NAT gateway for this, but I still feel insecure that instances can send personal information anywhere in the event of a capture.

What will be the most compact CIDR range that I can use for instance security group instead of 0.0.0.0/0?

+4
source share
2 answers

At this point, you may have to rely on the list of public IP ranges for AWS , allowing traffic associated with all CIDR blocks associated with your region.

Part of the resiliency design is for the most part that AWS relies on the ability of its service endpoints not to depend on static addresses and use DNS instead ... but their service endpoints should always be on addresses associated with your region, since there are very few services violate their practice of strict regional separation of service infrastructure.

(CloudFront, Route 53 IAM do, , , , . , .)

0

More articles:


All Articles