CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Database Tier Security in AWS: A SAA-C03 Question Walkthrough
Explore a common SAA-C03 question on database tier security. Learn the correct answer and why other options fail.
A common mistake candidates make is underestimating the importance of security group configurations. This question tests your understanding of how to manage access between application and database tiers effectively.
The question
A database tier must only accept traffic from the application tier. Which configuration achieves this with the least ongoing maintenance?
A. A security group on the database that allows inbound traffic from the application tier security group
B. A NACL that lists every application instance IP address
C. Open the database security group to 0.0.0.0/0 and filter in the app
D. Place both tiers in the same subnet with no controls
Think before you scroll
Consider how each option impacts ongoing maintenance. Some solutions may require constant updates, while others can adapt automatically as your application changes.
The answer
The correct option is A: A security group on the database that allows inbound traffic from the application tier security group. This configuration automatically adapts to changes in the application tier, minimizing maintenance tasks.
Why the other options lose
- B. A NACL that lists every application instance IP address: This option requires manual updates every time an instance changes. Managing a list of IP addresses is cumbersome and error-prone.
- C. Open the database security group to 0.0.0.0/0 and filter in the app: While this option allows traffic, it exposes the database to the entire internet. This approach compromises security and is not a best practice.
- D. Place both tiers in the same subnet with no controls: This lacks any security measures. It does not restrict access and can lead to potential security vulnerabilities, making it a poor choice.
The concept behind it
The key principle is using security groups to manage access dynamically. Security groups allow you to reference other groups, providing a scalable solution that adapts as your architecture evolves. This contrasts with static configurations like NACLs, which require ongoing manual updates.
Exam trap to remember
Always choose security groups for dynamic access control over static IP lists. Security groups automatically adjust as instances change, reducing maintenance.