Let's take a closer look at security groups and using a jump
box in order to manage your workloads.
Cloud environments have a security group as being a network
security boundary that can encase your workloads.
The default encasement is that there is default deny of access to
any workloads that are within a security group.
In the example given, I have two security groups,
one to house my database and the other to house my web application.
When I make an ingress rule on my database security group to allow
access from my application security group, that then becomes the
only service that's available.
When I configure my application security group to only
allow access to a secure HTTP port,
then that becomes the only ingress for that security group
in any workloads that are attached to it.
Now,
whenever someone interacts with the web server and the web server
needs to make contact to the database server,
it is only going to respond to the only rule that is allowed.
Let's say that I wanted now to manage that environment. I could actually
install a network address translation gateway and have a dedicated console
that has an IP address approved by the policy of the ingress rules of my
security groups, and then the cloud administrator could only be allowed
access to the cloud resources by logging in through that sole system that
has no other services running on it except those that are designed to
service the cloud workloads. Next, we'll actually go into the AWS Console
and create a security group for a web application and another for a
database and see what it looks like to actually do the configuration.