45 ms·
Also, don't use 0.0.0.0/0 in a security group rule! P.S. Azure has load balancers and security groups too- in fact their security groups are better than AWS's
by dharmab 6y ago
Also, don't use 0.0.0.0/0 in a security group rule!
P.S. Azure has load balancers and security groups too- in fact their security groups are better than AWS's in some ways such as supporting thousands of rules instead of only 50.
- ashtonkem 6y agoAzure can even configure mutual authentication between the LB & the underlying servers, which would cause any direct server access to result in a 401[0]. 0 - For API servers. I'm not sure if you could configure this with services like Elasticsearch.
- kevinkeller 6y ago>Azure can even configure mutual authentication between the LB & the underlying servers You can achieve a similar effect in AWS, by declaring only the LB's security group as the source in servers' security group ingress rule. Any requests sent directly to the servers simply wouldn't connect.
- ashtonkem 6y agoThat’s also a thing on Azure, but you can actually deploy certificates for mutual authentication as well. That way if somehow the network layer is pierced, you have another layer of protection.
- outworlder 6y agoThey do, but once you setup a load balancer, it wants to send all traffic through the load balancer. AWS and GCP load balancers are more like an endpoint. Your network is otherwise unaffected.