As promised,
we're now going to demonstrate creating a security group for a web
application and then another one for the database.
So,
what this will entail is creating security groups that give
explicit access to particular services.
This is that encasement that we were talking about.
The security group will only enable one service each,
and we're going to do this by logging into the AWS Console to
manage a virtual private cloud security group.
Let's go.
So, as stated, we are going to create two security groups,
one for the application instance and the other one for the database instance.
So, first thing we need to do is head over to our VPC,
which is the virtual network inside of the AWS Management Console,
and on the left‑hand side we're going to scroll down to Security groups.
If you select Create security group,
the first one that we're going to do is create the AppInstanceExternal,
okay.
That's what we'll call it for getting to the application
instance for external‑facing customers.
And we could actually add a description that says that,
Application Access for External Users port 443,
if we really want to be specific and descriptive.
So go ahead and add a rule there.
And what we'll do is we'll search for HTTPS.
That's the only type of access that we are allowing,
and we're going to say from anywhere.
Once you've done that, you can select Create security group,
and voila, we have the security group down here.
It's called the AppInstanceExternal.
Now if I go back over here to Security Groups,
I actually see that security group specified.
Now what we want to do is create another one for the database,
so this one is going to be called our DatabaseAccess.
So this is going to control where the database instance is
sitting and Access to Database from App,
okay.
So we're only going to allow the apps to get access here, right?
So if we scroll down, now,
we're going to add an inbound rule that is specific to a particular port,
and the port I believe we gave as an example was Oracle's RDS 1521.
Now the source could be the other security group that we had specified before.
Recall that?
So if I click inside of the Custom space,
I can actually find the AppInstance security group.
And if I go ahead and say Create security group,
I have actually made two security groups,
one that's allowing outside access from the outside world by means of
port 443 and another rule that's allowing the app instance to make a
referral to the database only across port 1521.
Those are the only accesses that I am allowing.
All right, we're done.