How do you configure the Security Groups to ensure that the entire application flow works per the requirements? Which Security Groups do you edit, and what rules do you create within them? 

As you are probably aware by now, Security Groups are AWS’s built-in firewalls for cloud resources. By default, all outbound traffic is allowed, but no inbound traffic is permitted; you must specify all ingress traffic based on IP addresses, IP ranges, or other Security Groups, and ports for specific services, to allow that traffic to reach a resource within the target Security Group.

For this discussion, assume you have the following resources deployed in AWS:

1. Three (3) EC2 instances, each running Red Hat Enterprise Linux with an Apache web server, hosting web interfaces for the Virginia DMV’s online vehicle registration portal, all part of a Security Group entitled “web-server-security-group.”
2. Three (3) EC2 instances, each running Red Hat Enterprise Linux with several Java Virtual Machines, which host the application servers to process the aforementioned vehicle registrations. These instances all fall under a Security Group entitled “app-server-security-group.”
3. Two (2) Elastic Load Balancers (ELBs) sit in their own VPC above these six (6) instances:
   1. The ELB for the app servers is called “app-server-load-balancer” with its own Security Group “app-server-load-balancer-security-group;”
   2. The ELB for the web servers is called “web-server-load-balancer” with its own Security Group “web-server-load-balancer-security-group.”

For the purposes of the discussion, we won’t expand the architecture include any database servers.

Also assume the following requirements:

1. Website traffic from end users renewing their vehicle registrations will enter the architecture on ports 80 (HTTP) and 443 (HTTPS).
2. App server traffic will be received exclusively from the internal web servers on a range of ports between 25500-25700.
3. The app servers must be able to send responses back to the web servers, and the web servers must be able to respond to the end users.

SAMPLE ASSIGNMENT

Sample-2