6 ms·
Why are you just allowing anything outbound or inbound? You can specify Allow/Deny on any combination of source subnet, dest subnet, source port, dest port for
by AzMoo_ 8y ago
Why are you just allowing anything outbound or inbound? You can specify Allow/Deny on any combination of source subnet, dest subnet, source port, dest port for starters. That gets you a pretty comprehensive ability to lock down a VPC on its own.
- Gelob 8y agoSay I want to allow outbound http/https to 10 different IPs. I can't do that in 1 rule like a traditional firewall.
- justnoise 8y agoJust in case those IPs are within your AWS account: you can apply a single security group to those machines and then use that security group as the destination in the outbound rule. If they're outside your account then, you're right, that's a shortcoming in AWS (Azure and GCP both allow multiple destinations in a single rule).
- Gelob 8y agoYes coming from outside aws, you're fucked
- AzMoo_ 8y agoIt's about 2 seconds work in CloudFormation though.
- iheartpotatoes 8y agoDumb question: if the IPs are coming from Route53 for web addresses, why don't you just point them as aliases to the same load balancer? Done and done, right?