A web tier receives HTTPS traffic from the internet, while a database must not be directly public.
The database needs outbound access only to obtain patches.
Which architecture is most appropriate?
Place the web tier in a public subnet and the database in a private subnet; use a NAT Gateway for the database's required outbound connections.
Detailed explanation
It exposes the database directly and permits an unnecessarily broad source range.
It exposes the database directly and permits an unnecessarily broad source range.
Patch retrieval is outbound; it does not require internet-initiated inbound access to the database.
Patch retrieval is outbound; it does not require internet-initiated inbound access to the database.
This separates the public entry point from the database and permits required outbound traffic without direct inbound exposure.
This separates the public entry point from the database and permits required outbound traffic without direct inbound exposure.
The layers are not separated and the database has greater exposure.
The layers are not separated and the database has greater exposure.
Check official documentation
Compare the following points with the official documentation.
VPCのパブリック・プライベートサブネットとNAT Gatewayの公式説明を確認する。
What to confirm
公開入口、DBの非公開、外向き通信をサブネットとNATで設計できる。
Key points
- Public subnet
- Private subnet
- NAT Gateway
- Layer separation
Notes
- Environment: AWS公式VPCドキュメントの確認
- Confirm current AWS service behavior and security guidance in the official documentation.
Foundation review
Inbound versus outbound
A database can initiate patch downloads through NAT without accepting unsolicited internet connections.
Defense in depth
Subnet routing and resource-level rules work together; neither should be replaced by broad public access.