3 ms·
AWS security groups and ACLs are the most worthless things. you cant treat them like a real firewall. you end up just allowing anything outbound or inbound. the
by Gelob 8y ago
AWS security groups and ACLs are the most worthless things. you cant treat them like a real firewall. you end up just allowing anything outbound or inbound. they dont let you be detailed enough
- AzMoo_ 8y agoWhy are you just allowing anything outbound or inbound? You can specify Allow/Deny on any combination of source subnet, dest subnet, source port, dest port for starters. That gets you a pretty comprehensive ability to lock down a VPC on its own.
- Gelob 8y agoSay I want to allow outbound http/https to 10 different IPs. I can't do that in 1 rule like a traditional firewall.
- justnoise 8y agoJust in case those IPs are within your AWS account: you can apply a single security group to those machines and then use that security group as the destination in the outbound rule. If they're outside your account then, you're right, that's a shortcoming in AWS (Azure and GCP both allow multiple destinations in a single rule).
- Gelob 8y agoYes coming from outside aws, you're fucked
- AzMoo_ 8y agoIt's about 2 seconds work in CloudFormation though.
- iheartpotatoes 8y agoDumb question: if the IPs are coming from Route53 for web addresses, why don't you just point them as aliases to the same load balancer? Done and done, right?
- kondro 8y ago100% disagree with this. There's no reason to not use whitelist first for almost everything… especially inbound. Even if you do want to make your internal comms life easier, you can use security-group-based rules that do any/any between the members of the group itself, effectively constructing VLANs easily between services.