I have a couple of EC2 Instances, ranging from Front-end servers, Back-end servers, Database servers and Node servers. They all communicate together and sometimes the developers needs to access these servers so I have certain ports open to accept connections from any IP after verification.
Since I am not a security expert, I am concerned that I might be missing something and opening such ports to the mass could expose my servers of getting accessed by unwanted guests. So I was thinking in locking down all connections to my servers, to be accepted only from the VPC (Virtual Private Cloud) network they are connected to. So for anyone, including my developers, to be able to access the servers they have first to connect the VPC. That why all connections from unwanted parties, will be automatically rejected by AWS Cloud Firewall.
My question here, what can I use to do that? Or what is the best approach? I have red a couple of tutorials for different scenarios but I have no idea what would work. I have red an article about AWS VPN CloudHub, VPN Servers from the marketplace to run on normal EC2 instances or AWS Managed VPN Connection.
EDIT: I have also found a service called AWS PrivateLink