2

I'm about to launch my first ever SaaS product on AWS and am thinking through security.

I have my main server, which is obviously public on :80 and :443, and then I have a bunch of other infra that I need access to as a developer (typically on :22) but that I don't want to be fully public.

I was thinking I would rent a dedicated IP through one of the VPN companies and then set AWS security groups to only allow traffic from that IP for those kinds of services.

How secure is this approach? Is there a better way I'm not thinking about?

3 Answers 3

2

That approach would work. So you would have your dedicated VPN IP that is the only IP address whitelisted ("nnn.nnn.nnn.nnn/32") in AWS for port 22. This is best if you need to access your AWS resources from several different networks (home, office, coffee shop, etc.). If you only needed to access AWS from a fixed office, you could whitelist the address block for your office's ISP. Anyone from within that ISP could talk to your SSH service so it is not at tight as it could be. A quick search tells me that dedicated IP VPNs are $10-$20/month. You just have to decide if that added security worth the added cost to you.

Obviously it makes securing your VPN credentials the most important part of your setup. Make sure to enable MFA for the VPN access. And I would still recommend SSH key-based auth where the private key uses a different password from the VPN password.

2

At that point in time it wouldn't be any different than just whitelisting your home or office IP address in your AWS security group. While such IP addresses do change, these days they don't usually change often and (presumably) you will know if they do. Therefore I'm not sure if you gain much by purchasing a VPN and whitelisting its IP address, unless your goal is to be able to connect easily when working at the local coffee shop.

Of course, limiting access via IP address hearkens back to the days of centralized networks, which are (hopefully) dying in exchange for zero-trust. So while this is (likely) a fine way to get started, this isn't necessarily as effective, easy-to-manage, or secure as a more robust access management system.

AWS in particular has the SSM agent that can allow you to connect to machines without having to open an external port, and you can also look into a PAM (Privileged Access Management) system. The former is something you could do now, while the later is something that is intended more for enterprises.

Which of these options works best for you just depends on your own personal risk tolerances

1

If you only have a single server, and need SSH access to it, the best way (IMHO) is to use AWS Session Manager.

It involves an agent on your server, which will create a connection out to the Session Manager service (almost like a reverse shell). You can initiate the shell connection via the AWS Console, and all sessions are logged.

The agent will need outbound network connectivity, and an EC2 instance role, but generally speaking this is easy to setup.

The advantage though is that you don't need to bother about IP whitelisting, or opening up additional inbound ports on your server, and it's free!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.