My small company is developing a webapp on AWS, using VPC and EC2 Container Service, with Application Load Balancers directing traffic to our apps. I have the environment up and running, but I want to secure it so that only people in our company can access it. I'm not quite sure what the ideal solution is--how have other people solved this?


It's fairly simple:

  • Create an IPsec tunnel between the VPC and your corporate network.
  • Don't assign EIPs or other public addresses to anything other than NAT/egress gateways. If you want to really isolate things, set the VPC routing tables so the default route points to your office router and configure that to NAT for the VPC subnet. This way all traffic from the VPC, even that which is internet-bound, is forced to travel through your office network first, where it is subject to the same traffic inspection rules as the rest of your office traffic.
  • Configure firewall rules to only allow connections from the private address space of your corporate network.
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.