I have several external (client owned) servers communicating with an EC2 instance using a program installed on their servers (by me).
Currently the program performs no authentication, We install the program on client servers, then add their IP to an AWS security group attached to our EC2 instance.
We are currently running out of space in the security groups (already have the max allowed number of IPs in 5 security groups). How can I best improve the security here, assuming I'm worried about external threats- not the client servers sending bad data?
CLIENT------->SECURITY GROUP----> CENTRAL AWS SERVER
- remove security groups entirely and properly implement a public/private key system between the program and my AWS server?
- implement a WAF for the http traffic and filter IPs there.
- run a VPN on the client servers which allows access to my network for a specific port.