CLF-C02 Practice Question 114: Security Group References
AWS Certified Cloud Practitioner (CLF-C02) · Test 12 · question 4 of 10
A three-tier application has web servers in an Auto Scaling group that uses the security group web-sg, and database instances that use the security group db-sg. The databases must accept MySQL traffic on port 3306 only from the web servers, and not from any other resource that might be launched in the same subnets. The web servers' IP addresses change as instances are added and removed. How should the rule be configured?
Show answer and explanation
Answer:
A security group rule can reference another security group as its source. That is one of the reasons AWS calls security groups more versatile than network ACLs. With web-sg as the source, the database accepts port 3306 traffic from any instance *associated with* web-sg, whatever its current IP address. That handles Auto Scaling automatically, and it excludes other resources in the same subnets that don't use web-sg. Because security groups are stateful, the database's responses are allowed back automatically.
Option A works at the IP level, so *any* resource launched in those subnets could reach the database, which the requirement rules out. Option C does the opposite of restricting access: it allows port 3306 from everywhere at the subnet level. Option D can't be done, because security groups support allow rules only, and a rule on the web servers wouldn't control who can reach the databases anyway.
References: Infrastructure security in Amazon VPC; Control traffic to your AWS resources using security groups