Business Application Rule for AWS Beanstalk

Question

Hi all, 
 I have set up an web application on AWS Elastic Beanstalk environment. 
 This application has to access a MySQL server that is located in LAN. Depending on the load Beanstalk is launching several EC2 instances, which are all behind a load balancer. 
 As the EC2 instances are launched and terminated automatically I think I cannot predict the public IP. 
 
 As only these servers need access to the MySQL server I would like to restrict the access, so that nobody else is able to connect to the MySQL server. 
 
 Is there any possibility to create a suiteable firewall policy? 
 
 thanks, 
 caldi

lferrara · Answer

Caldi, 
 you can restrict the source network from any to the public IP or dns names. 
 Allowing access to Database from external sources is against security principle. You should allow access to a web server on DMZ zone and then have a SQL machine on LAN or a dedicated VLAN. 
 Regards

lferrara · Answer

Caldi, 
 as I wrote from the security prospective, you should not allow access to Databases from an untrusted network. Publish only web app on different zone. 
 If your access is every 2 months, you can create a Firewall policy and keep it turned off until you need the access. For Web Application, put them behing WAF module and keep them really updated and restrict the access to it and admin page. 
 Regards