How do you restrict access between Subnets within the same VPC?

Question

So I have been following some VPC architect guide(s), which encouraged me to zone subnets by layers (instead of simply public/private subnets)

Then I decided I would have these subnets:

• elb-public
• elb-internal
• service
• database

Now I want to forbid anything within the elb-* subnets to reach the database subnet. By default, everything within a VPC can reach each other via the local route in route tables, and AWS doesn't allow the deletion of these routes, which is not my desired behaviour.

In the article I linked above, there's an approach that splits everything to VPCs and connect them with VPC peering, so in other to restrict access between VPCs I can simply don't peer them. But this approach seems a little complicated to me and I wish to find a solution that doesn't require me to split anything to VPCs.

How do I achieve the use-case mentioned?

Answer 1

Network ACLs will do what you need. Keep in mind they are stateless so you have to allow ephemeral ports. https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

Best practice is to use Network ACLs to define coarse rules of which subnets can talk to each other, and then use Security Groups for more fine-grained rules based on the application/role of a specific server. https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

Answer 2

That guide is documenting a very "strict" security design. It is rather complicated.

If you have a smaller application, you could instead use Security Groups to achieve a similar result using only one subnet (or you might prefer one public and one private subnet).

Traditional network can only put firewalls between subnets, but a security group can provide a firewall around each individual resource.