TLS/SSL Config with AWS Beanstalk and website A record

Question

Can someone provide the appropriate security architecture and setup for the following setup?

• PHP app via AWS Beanstalk
  • Let's say its IP is 10.10.10.01
• Existing website
  • No TLS/SSL currently
  • A record created to point subdomain "myapp" to IP 10.10.10.01 (Beanstalk app)

Given the scenario of someone needing to post data to "myapp.mysite.com", which is just reading from the AWS Beanstalk PHP app, how should the TLS/SSL be configured?

I.e. A certificate should be created for myapp.mysite.com and the 443 port on the Beanstalk app should be opened.

Hope I explained this well enough and thanks for your help in advance.

Answer 1

• The user is communicating with mysite.com

So the SSL certificate should apply to mysite.com to encrypt the connection between the client and the server and encrypting the data on that route

• mysite.com needs to post data to a different server and so needs to be able to write

Depending on your PHP application there may be some failure here, and you should probably have a check in here that it comes from where it is meant to (although this could be fairly easily bypassed). You should not need to be aware of CORS since it sounds like the post is happening internally.

• internally the website can open a secure connection using whatever codebase you're using

If instead the user is on the same network as the AWS Beanstalk app then you can not worry about step 1 or 3, and instead get the SSL certificate for your subdomain, but be aware of CORS.