Create Security Group

Create Security Group for External (Internet Facing) Load Balancer

  1. In the VPC interface, choose Security groups on the sidebar, then click Create security group to create a security group for the ELB (Elastic load balancer) to be created Create security group

  2. In the create security group interface:

    • Name enter InternetFacing-LB-SG
    • Description enter External load balancer security group Create security group

  3. Set up Inbound rules, by adding the following rules:

    • First rule allows access to HTTP, and Source: Anywhere-IPv4
    • Second rule allows SSH from My IP which means personal IP, will change when you change the network
    • Last rule Type: All ICMP - IPv4 and Source: Anywhere-IPv4 allows ping from any IP address Create security group

  4. Scroll down to the bottom and click Create security group Create security group

  5. Finish creating SG for ELB Create security group

Create SG for Web tier

  1. Repeat the above steps to create SG for Web tier (present layer with user, can be understood as front-end) Create security group

  2. Set up Inbound rules, by adding the following rules:

    • First rule allows access via HTTP but only with source from InternetFacing-LB-SG we just created above (according to the designed structure)
    • The following rules are similar to creating SG for ELB Create security group

  3. Scroll down to the bottom and click Create security group Create security group

Create SG for Internal load balancer

  1. Create the 3rd SG for Internal load balancer Create security group

  2. Set up Inbound rules:

    • Type: HTTP choose Source: WebTier-SG allows access to HTTP from the web tier SG
    • Then click Create security group Create security group

Create the 4th SG for App tier (private instances)

  1. Create the 4th SG for App tier (private instances) Create security group

  2. Set up Inbound rules:

    • Type: Custom TCP, Port: 8080 and Source: Internal-LB-SG allows traffic from internal load balancer to enter
    • And 2 similar rules but Source: Anywhere-IPv4 and My IP
    • Then click Create security group Create security group

Create the 5th SG for DB tier

  1. Create the 5th SG for DB tier (private instances containing MySql) Create security group

  2. Set up Inbound rules:

    • Type: Custom TCP, Port: 3306 and Source: AppTier-SG allows traffic from app tier to enter
    • Then click Create security group Create security group
    • You can add more rules to allow traffic from other sources for testing purposes Create security group

  3. Finish creating 5 SG for the designed structure Create security group