kostaleonard / populare-iac

Populare infrastructure as code.
MIT License
2 stars 0 forks source link

Disallow 3306 egress from RDS security group #28

Closed kostaleonard closed 2 years ago

kostaleonard commented 2 years ago

The Terraform RDS guide here allows both inbound and outbound 5432 (Postgres) traffic. However, this does not appear to be necessary, as outbound traffic would not be on the database port unless the RDS instance is querying another database. Additionally, according to AWS docs, security groups allow inbound/outbound responses to established connections, so adding outbound traffic rules for the RDS security group is unnecessary. Lastly, I tested removal of this rule, and the proxy communicated with the database perfectly fine. Remove the 3306 egress rule from the RDS security group.