Welcome back!
In Part 2 of this series, we will be securing our network environment by creating Network Access Control Lists (NACL) & Security Groups.
Let's get started!
Making Public Subnet 1...Public
By default, nondefault subnets have the IPv4 public addressing attribute set to false, and default subnets have this attribute set to true. An exception is a nondefault subnet created by the Amazon EC2 launch instance wizard — the wizard sets the attribute to true.
In future steps, we will launch an EC2 Instance into the Public Subnet which will now automatically have an Ipv4 address assigned to it.
- Click "Enable auto-assign public Ipv4 address":
Network Access Control List (NACL)
A network access control list (ACL) allows or denies specific inbound or outbound traffic at the subnet level. You can use the default network ACL for your VPC, or you can create a custom network ACL for your VPC with rules that are similar to the rules for your security groups in order to add an additional layer of security to your VPC.
Create Public Subnet NACL
- In the left-hand pane of the VPC dashboard, under security, click Network ACLs:
- Click Create Network ACL:
Adding Inbound Rules to NACL
Adding the inbound rule that uses port range 32768-65535 will allow responses from outbound requests such as requesting patches/updates.
Add three inbound rules
Rule Number: 100, Type: HTTP (80), Source: 0.0.0.0/0
Rule Number: 200, Type: All ICMP -IPv4, Source: 0.0.0.0/0
Rule Number: 300, Type: Custom TCP, Port Range:32768-65535, Source: 0.0.0.0/0
Adding Outbound rules to NACL
You must create an outbound rule on a network ACL since network ACLs are stateless. This means that incoming traffic is not automatically allowed to be responded to. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it.
You must create an outbound rule on a network ACL since network ACLs are stateless. This means that incoming traffic is not automatically allowed to be responded to. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches traffic, it's applied regardless of any higher-numbered rule that might contradict it.
Associating NACL with Subnets
Each subnet in your VPC must be associated with a network ACL. If you don't explicitly associate a subnet with a network ACL, the subnet is automatically associated with the default network ACL.
Create the Private Network ACL
*For any property not specified, use the default value
Security Groups
A security group controls the traffic that is allowed to reach and leave the resources that it is associated with. For example, after you associate a security group with an EC2 instance, it controls the inbound and outbound traffic for the instance.
Create Public Web Server Security Group
Create Private App Server Security Group
The private app server security group has identical rules to the public web server security group except the incoming traffic source is the WebServerSPASG security group. Utilize all aforementioned steps to complete the creation of the AppServerSPASG security group.
We have now laid the groundwork for launching our Web and App servers in the public and private subnets, respectively.
So what have we completed?
Enabled Public Access for a subnet
Created a Network ACL for both public and private subnets
Created security groups for the servers we will launch in the upcoming steps
In Part 3 of this series, we will:
Launch our Ec2 Instances with a script to install web server dependencies
Install CloudWatch Agent for custom logging
Add Auto Remediation for overutilization
Stress test our server
Great job! See you in the final installment of this series.
