3 ms·
For a network with several hundred instances where each instance has a public IP, the borders of your network become quite wide. You now need to audit several d
by kesor 11y ago
For a network with several hundred instances where each instance has a public IP, the borders of your network become quite wide. You now need to audit several dozen security groups.
When you setup a private subnet, there are a lot less security groups, and access points in general, which makes it much easier to audit and maintain reasonable security for.
This is especially true where unprofessional people start and stop instances (say developers) and don't have the same security mind-set, making it a risk of human-error that causes services which normally should be protected to be open to the world.
- zAy0LfpBZLC8mAC 11y agoWell, then you have to make it so that new instances automatically contain your packet filter. You have to think outside what the current implementation easily supports, which obviously reflects the limitations of the current network setup, and think about what would be possible if those limitations didn't exist. And it's obviously technically possible to automatically deploy the same packet filter to each VM that gets added to your network range ... Also, as I said, the point is not that a central firewall cannot ever be a good solution--but with the current limitations, you have no other choice even when it doesn't really make much sense.