SAA-C03 Practice Question 62: Security Group Referencing
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 7 · question 2 of 10
A three-tier application has a separate security group for the load balancer, the application instances and the database instances. The database security group allows the database port inbound from two hard-coded subnet CIDR blocks, which are the subnets the application Auto Scaling group originally used.
The team expands the Auto Scaling group into a third, newly created subnet. Instances launched in that subnet come up healthy but every database connection they open is dropped, while instances in the two original subnets are unaffected. The team expects to add more subnets as the application grows.
What should the architect change so that this class of failure does not recur?
Show answer and explanation
Answer:
A security group rule can take another security group as its source. The rule then applies to every instance associated with that referenced group, communicating over its private IP address, regardless of which subnet or Availability Zone the instance happens to be in. Referencing the application tier's group therefore makes the database rule track group membership rather than addressing, so instances launched into any current or future subnet are covered the moment they come up. AWS documents this three-tier pattern explicitly, and a rule that references a group counts as a single rule no matter how many instances are in it.
Option A restores service but leaves the design unchanged: the rule still encodes addresses, so the next subnet causes the same outage. The question asks for a fix that prevents recurrence.
Option B also restores service and is worse for security. It authorises the database port from every address in the VPC, including subnets that have nothing to do with the application tier, which throws away the tier isolation the three security groups exist to provide.
Option D is the wrong control. The security group is what dropped the traffic, and if the database subnets use the default network ACL it already allows all traffic, so the rule changes nothing. Network ACLs are also CIDR-based and stateless, so building the tier boundary there would have the same brittleness as option A plus the need for matching ephemeral-port rules.
Reference: Security group rules