AWS Security Groups’ Best Practices

AWS Security Groups

Create a small number of security groups that can be combined together to create the desired security configuration. We recommend having a generic group for a resource of each type with all common rules, and a specific group for each individual resource with the particularities.

Recommended Security Groups:

• A generic default group for each resource type: these groups are used to hold default groups that apply to the type of resource, for example, the SSH access to EC2 instances from a fixed administration IP address or the access to the database port for administration from a fixed administration IP.
  Examples:
  • ditwl-sg-rds-mariadb-def: default security group for all the MariaDB RDS resources. It is specific for MariaDB RDS resources as another type of database will use a different port.
  • ditwl-sg-ec2-def: default security group for all EC2 instances. It will have the SSH access rule.
• A specific group for each resource:  It is recommended to have a group for each resource, it will be named using part of the resource name and the prefix will have the cloud and the resource type. Examples:
  • ditwl-aws-sg-rds-mariadb-pro-pub-01: security group for all the MariaDB RDS resources.
  • ditwl-sg-ec2-pro-pub-01: security group for all the WP EC2 instances.

Avoid creating too many groups and don’t use CIDR as a source (except for Internet as a source). It is better to use groups as a source, that way an element gets access to other resources by being a member of a group, not by having a specific IP that can change.