Glue or EC2 processing connects to Aurora.
Keep the database private and allow only the processing security group on the database port.
Which authentication approach is most appropriate?
Reference the processing security group in the database security group's inbound rule for the required port.
Detailed explanation
IAM and CloudTrail do not control security-group network reachability.
IAM and CloudTrail do not control security-group network reachability.
Dynamic processing nodes are permitted without opening a broad CIDR range.
Dynamic processing nodes are permitted without opening a broad CIDR range.
The database would be reachable from the entire internet.
The database would be reachable from the entire internet.
Authentication does not remove unnecessary network reachability.
Authentication does not remove unnecessary network reachability.
Check official documentation
Compare the following points with the official documentation.
AWS Security Groups referencing security groups、stateful rules、Aurora networkingの公式説明を確認する。
What to confirm
0.0.0.0/0・パスワード依存と、SG参照による最小到達性の違いを説明できる。
Key points
- Security Group
- Source SG
- Database port
- Least privilege
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Stateful behavior
Return traffic is tracked, but outbound rules and network ACLs still need review.
Dynamic workers
Security-group references avoid depending on changing worker IP addresses.