Locking AWS Instances connections

Question

I have a couple of EC2 Instances, ranging from Front-end servers, Back-end servers, Database servers and Node servers. They all communicate together and sometimes the developers needs to access these servers so I have certain ports open to accept connections from any IP after verification.

Since I am not a security expert, I am concerned that I might be missing something and opening such ports to the mass could expose my servers of getting accessed by unwanted guests. So I was thinking in locking down all connections to my servers, to be accepted only from the VPC (Virtual Private Cloud) network they are connected to. So for anyone, including my developers, to be able to access the servers they have first to connect the VPC. That why all connections from unwanted parties, will be automatically rejected by AWS Cloud Firewall.

My question here, what can I use to do that? Or what is the best approach? I have red a couple of tutorials for different scenarios but I have no idea what would work. I have red an article about AWS VPN CloudHub, VPN Servers from the marketplace to run on normal EC2 instances or AWS Managed VPN Connection.

EDIT: I have also found a service called AWS PrivateLink

Answer 1

You should be using a bastion host along with a DMZ.

Bastion Host

Also called a "Jump Host". Your application servers (app, db, etc) are set up so there's no direct route to them from the internet, only to the web servers. If those back end servers need internet access, say for updates, then you use a NAT gateway or NAT instance.

Any administration of servers, port 22 / RDP, must go via the bastion. That bastion is locked down with a variety of methods, including only accepting requests from specific IP addresses (use security groups and / or NACLs) and needing a certificate to log in (this is the default with AWS anyway). You could go crazy and implement multifactor authentication, but I don't know how that would be done - never tried it.

DMZ

The DMZ is part of an N tier architecture. It helps ensure there is no route from the internet to your app / DB servers.

Other options

Another option is to put your web server behind a WAF / CDN, such as AWS CloudFront or CloudFlare (who has a free tier). These typically recognize and stop layer 7 attacks and DDOS attacks. You use a firewall ensure no-one can connect to your web servers directly, that they must go through the WAF / CDN.

An AWS load balancer includes AWS Shield Basic, which provides another line of defense. Security is often about layering of defenses.

Intrusion Protection / Detection is another thing you can do, but it's non-trivial and could be more than you need.

Notes

There are plenty of other things you could do, but the ones above are probably the main ones. Systems that need high security tend to have multiple security professionals working for weeks or months to secure them.

Privatelink is unlikely to be helpful for you. It's to connect to VPCs to together to provide services directly rather than via the internet.