Security for External Communication to an EC2 on AWS

Question

I have several external (client owned) servers communicating with an EC2 instance using a program installed on their servers (by me).

Currently the program performs no authentication, We install the program on client servers, then add their IP to an AWS security group attached to our EC2 instance.

We are currently running out of space in the security groups (already have the max allowed number of IPs in 5 security groups). How can I best improve the security here, assuming I'm worried about external threats- not the client servers sending bad data?

CLIENT------->SECURITY GROUP----> CENTRAL AWS SERVER

My thoughts:

1. remove security groups entirely and properly implement a public/private key system between the program and my AWS server?
2. implement a WAF for the http traffic and filter IPs there.
3. run a VPN on the client servers which allows access to my network for a specific port.

Answer 1

Security Groups are a network level protection, while any public/private key system is usually an application level protection. You can apply both.

But if you're already maxing out your IPs in security groups, chances are the server is more or less public already, we need to think about other ways to restrict access that's going to be sustainable.

So yes, use some application level authentication, and allow all IPs to access the server. Remove the security group, but place the EC2 in a public subnet with an internet gateway (there you'll get access to Security Groups, NACLs etc). Use security groups to grant access only to the port of your application (and nothing else). Use System Manager Session Manager for SSH access.

Implementing a WAF is also a good idea, to protect your server from hacks (once you open it up to the whole internet). But you shouldn't use it to filter IPs, it's not built for that -- WAFs are meant to deny malicious IPs, not to filter out for User IPs. So put the WAF in place to protect your now free-ly accessible server.

Running a VPN is actually the best idea. That way your communication can be private all the way (although I'd still recommend at least some authentication).

Other recommendations including placing all of this behind cloudfront (if HTTP based), ensure your applications logs all user logins (using cloudwatch of something similar), and frequently monitor your EC2 instance for anomalous activity (CPU-spikes, large network egress etc).