Okay.
Hello bloggers and welcome to this lecture and this lecture we're going to look at security groups.
So this is a lab and you will need to log into the database console.
Okay so here I am in the adobe us console.
We're going to go to E2 which is under compute and we're going to click in here and we'll be able to
see our instance.
Now if we click on our instance and grab our public IP address we can go ahead and load our web page.
So want you to navigate over to your public IP address and load your web page.
Okay.
So here I am in my browser I'm just gonna pasted in here and you can see straight away it says hello
cloud gurus.
So I go back over to E2 just gonna maximize the screen.
So the reason we're able to browse to our Web page is web enabled port 80 on our security group and
port 80 is just the DP port and you can see your security groups just by scrolling down here.
There's always going to be in the description.
So here's my security group here.
I can actually click in here and view my inbound rules and we can see here the port 80 and port 22 are
open to the world and that my security group is called Web DMC.
So let's go over and edit our security group suits here under network and security.
You can see security groups.
And if you're able to create security groups delete security groups edit security groups et cetera.
So we go over to our Web DMZ.
We can just make this a little bit bigger so we can all see.
So got our description in here and it's basically just the name of our security group.
The idea of it and then the description and then which BPC it's in.
And then if we click in here we've got our inbound rules.
So we've opened up each DDP on port 80 and we've done this to 0.01 dot dot 0 Ford slash 0.
So this is IP V4 also done on an IP v 6.
And we've also done SS H on Port 22 to IP V for.
So if I go ahead and delete this rule what if I go in and edit and delete my to port 80 rules and hit
save.
What do you think is going to happen.
How quickly do you think this is going to take effect.
I go back over to my browser I click in here and hit refresh and you can see down here it says connecting
it's going to hang for about a minute and then it's going to timeouts every time you make a rule change
on a security group.
That change takes effect immediately and that can be really popular exam question going into your exams.
So that took just over 60 seconds but you can now see that it has timed out.
So by deleting that rule in the security group the change took effect immediately and are now cannot
access the website.
I go back to the adobe management console I can go in here and I can go through and we're going to go
in and add each GDP and we're going to do it for port 80 and by default we're going to open it up to
both IP for an IP B6 and hit safe.
And if we scroll down we can now see that that rule has taken effect on our Web DMZ.
Sorry I just click in here so you can see it in here now.
I'll just full screen this.
So it's easier to see.
So now you can see HDTV and each DP on IP for an IP B6.
And if I just go back over to my other browser that is now loading immediately to Hello cloud viewers
have learned that if you make a change to a security group that change takes effect immediately.
Let's have a look at our outbound rules soon here.
We've got an outbound rule over all traffic protocol for everything port for everything destination
to everything.
What would happen if we go and delete this.
Would that delete all our outbound traffic would we suddenly be able to send a request to our EOC to
instance but nothing will then come back out.
Let's go and test that.
I'll just come out of full screen and in here if I hit refresh and you can see that it loads immediately
so by deleting that rule nothing happened.
And the reason for that is security groups are state fault.
So essentially when you create an inbound rule an outbound rule is created automatically.
So if you allow hasty VPN it's automatically allowed out as well.
The allow ADP in or if you allow SSA or you allow my sequel in it's automatically going to be allowed
back out.
Now when we get to the VPC section of the course you're going to learn about network access control
lists or nationals as we like to call them.
And those are state lists.
So when you create an inbound rule you also have to create an outbound rule as well.
So we have security groups a state for network access control is a state less.
And that's something we'll learn again in the VPC section of the course.
Also I want you to have a look in here.
If I go to edit and I go to add a rule there's no way I can add rules all I want.
I can allow no traffic over Oracle RDX or redshift or S.M. yes whatever whatever port it is I can allow
but I can't actually go in and block an individual port I can't go in and say hey don't allow any traffic
across this.
There's no way of blacklisting a particular port and likewise there's no way of blacklisting a particular
IP address.
He can't do that with security groups.
We can do that is with network access control list and again we're going to look at that in the VPC
section of the course.
But for now what's really important is just to remember that you can't block individual IP addresses
using security groups and you can't block an individual port.
But the way security groups work right is when you create a security group everything is blocked by
default.
You have to go in and allow something.
So everything is blocked by default.
But when you go in and allow each DDP or my cycle then their traffic is allowed through.
So that's another thing to take away going into your exam.
So I'm just gonna close this and go ahead and hit save.
Next thing we're going to do is just go over to our default security group and what I'm gonna do in
here is I'm going to add some inbound rules so let's go and add my sequel for example so scroll down
my sick or Aurora so 3 3 0 6 and let's add Sequel server which will be 14 33.
So if we find a sequel server just right here Emma sequel.
And so 14 33.
There you go.
Go ahead and hit save.
And then it's just given me saying that I need to enter an insider address range.
So I put ow ow ow ow forward slash ow ow ow ow ow ow ow forward slash.
Oh and there we go.
I'm gonna go ahead and hit save and that has now allowed my sequel and MSA sequel through our default
security group.
Now if we go back to easy to and click on our running instances can see in here that we've only got
one security group attached to this easy to instance you can attach more than one security group to
an AC to instance the way you do that is you just click on actions and you go over and you go over to
networking and here you go change security groups and we can go ahead in here and click assign security
groups and we now have two security groups assigned to our easy to instance so we've got our default
one as well as our web DMC.
We click on View inbound rules.
This actually looks a little bit better now because we can actually see which ports are open by which
security group.
So we're saying here that web DMC is allowing port 80 and port 22 and our default is allowing port 14
33 as well as 3 3 0 6.
So it's allowing my sequel in as well.
So that's how we can add and remove security groups and of course if you add a security group to an
easy to instance that effect takes place immediately.
So I'm just gonna go in and I'm going to just clean up I'm going to go back to my security groups and
I'm going to delete my I'm not going to delete my default one but I am going to delete those rules that
we just created because you really don't want my sequel and SQL server access open to the entire world
is not a very good security practice.
And the next thing I'm going to do is just go go back over to E.C. too and I'm going to remove that
security group so forget it actions and then go over to networking and change security groups.
Just gonna remove the default one to make sure that it's still in the web DMC.
So let's go have a look at my exam tips.
So onto my exam tips.
Just remember that all inbound traffic is blocked by default.
So you have to go into a security group and enable it.
So we went in enable port 80 we enabled port 22 SSA.
We enabled my sequel et cetera et cetera.
So you all inbound traffic is blocked by default but then you can go in and enable individual ports.
Remember that all outbound traffic is allowed.
So even if we went in deleted that rule has no effect on a security group whatsoever.
And the reason for that is security groups are stable which are about to come up to changes to security
groups take effect immediately so as soon as we deleted port 80 we could no longer access our websites
and as we added it again we could.
You can have any number of easy two instances within a single security group and you can also have multiple
security groups attached to two instances so there is not a one on one relationship at all.
You can have as many easy two instances within an individual security group as you want.
And likewise you can have multiple security groups attached to individual easy two instances.
We learnt that security groups are state full.
So we don't have to change inbound and outbound ports if you enable something on the inbound outbound
is enabled automatically for that port.
And if you create an inbound rule allowing traffic in which is exactly what I just said that traffic
is automatically allowed back out again and you cannot block specific IP addresses using security groups
instead you're going to do this using network access control lists and we're going to learn all about
that in the VPC section of the course.
And then finally you can specifically allow rules but you cannot set any deny rules in a security groups
if you see any scenario questions about setting up a deny rule on a security group.
Security groups don't work like that.
By default they deny everything.
But then you go in and allow you can't put a specific deny role on a security group but you can do that
with network access control list.
And like I said we will cover that off in the VPC section of course.
So that is it for this lecture goes if you have any questions please let me know if not feel free to
move on to the next lecture where we're going to look at CBS volumes you got the time.
Please join me in the next lecture.