When using AWS, you can imagine your infrastructure as being contained in your own virtual data center. This is called a VPC. Each VPC is then subdivided into multiple subnets. So far, we have used the default VPC and subnets. Take the example of us-east-1. As we can see in the following image, our default VPC is using the 173.31.0.0/16 network. Within this network, we have a subnet for each availability zone.
In addition, each AZ is directly connected to an internet gateway:
This gateway is what makes it possible for our EC2 instances to have both a public and private IP. This is also what we want to change. One of the common best practices in security is to minimize the attack surface. As services and applications become more and more complex, the likelihood of opening a security group too much also increases. What we want to...