HTTPS from the internet terminates at an Application Load Balancer.
Web instances must accept application traffic from the load balancer only, not direct external traffic.
Choose TWO appropriate design elements.
Expose the ALB as the public entry point and allow the web-tier security group to receive traffic from the ALB security group rather than from every internet address.
Detailed explanation
Referencing the ALB security group limits the web tier's source to traffic coming through the load balancer.
Referencing the ALB security group limits the web tier's source to traffic coming through the load balancer.
That rule permits direct access from any IPv4 source and defeats the ALB-only requirement.
That rule permits direct access from any IPv4 source and defeats the ALB-only requirement.
Network ACLs are subnet-level and cannot express a resource security-group reference in place of the web-tier rule.
Network ACLs are subnet-level and cannot express a resource security-group reference in place of the web-tier rule.
The ALB is the intended public entry point and can accept HTTPS before forwarding to the protected web tier.
The ALB is the intended public entry point and can accept HTTPS before forwarding to the protected web tier.
Check official documentation
Compare the following points with the official documentation.
VPC Security Groupの参照とALBの公式説明を確認する。
What to confirm
ロードバランサーとターゲットのSecurity Groupを連鎖させられる。
Key points
- Application Load Balancer
- Security group reference
- Layered network boundary
Notes
- Environment: AWS公式VPC・ELBドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Layered entry
The ALB accepts public traffic while the web instances accept only traffic sourced from the ALB security group.
Resource versus subnet control
Security-group references express the resource relationship more precisely than a subnet-level NACL.