Network Load Balancers supporting security groups.<p>I've gone through a bunch of audits, and automated scans, and I constantly have to explain this shit, even to AWS Employees.<p>How it works with ALBs, which do support security groups:<p>You want to receive traffic on port :443, and allow it to be accessible to the world.
You have EC2 instances, and they are listening on the VPC at port :1234<p>So, you create:<p>- ALB my_alb which listens on :443, and forwards traffic to tg_traffic<p>- Target group tg_traffic, which contains the EC2 instances and targets the EC2 instance with port 1234<p>- Security Group sg_alb, attached to my_alb with two rules:<p><pre><code> - rule 1, inbound, from 0.0.0.0/0:443
- rule 2, outbound, to sg_servers:1234
</code></pre>
- Security Group sg_servers, attached to the EC2 instances with one rule:<p><pre><code> - rule 1, inbound from sg_alb:1234
</code></pre>
This makes everyone happy. The rules require that traffic from the internet has to go through the ALB.<p>Now how it works on a NLB, with the same scenario:<p>You want to receive traffic on port :443, and allow it to be accessible to the world. You have EC2 instances, and they are listening on the VPC at port :1234<p>However, NLBs, as mentioned, don't support security groups.<p>So, you create:<p>- NLB my_nlb which listens on :443, and forwards traffic to tg_traffic<p>- Target group tg_traffic, which contains the EC2 instances and targets the EC2 instance with port 1234<p>- Security Group sg_servers, attached to the EC2 instances with one rule:<p><pre><code> - rule 1, inbound from 0.0.0.0:1234 (not :443, because the NLB translates the port for you, but not the source ip)
</code></pre>
...that's it.<p>However, now every audit/automated scan of the EC2 instance & it's security group is going to see that you're listening on some random port, and allowing traffic from anywhere. This throws errors/alerts all the time. Even AWS's automated scans are throwing these alerts.<p>When it's an auditor you have to take the time to explain that, no, that's how NLBs work. For automated scans, you have to just ignore the warnings/errors constantly.<p>If your instance has no public IP associated, then at least only that port is exposed, and traffic does have to go through the NLB.<p>If for some reason the instance does have a public IP associated, then anyone who can reach the public IP can bypass your NLB.<p>If you could have a SG attached, then you could force the traffic to go via the NLB and not come direct to the instance.