This question already has an answer here:
I'm curious about best practice when connecting from app to DB in a cloud provider. A quick rundown of our setup.
We have 4 servers all on the same provider, in the same region running as VPS. Ngnix is the reverse proxy, load balancing to 2 Node.JS servers. The Node.js servers connect to a MongoDB server.
So my question is around security when it comes to the Node.js > Mongo connection. We have the Mongo and Node servers restricted to only connect to each other over LAN via IP tables. The DB and Node instances are not accessible outside the LAN. We also have enabled SCRAM-SHA-1 authentication on the MongoDB.
Do we need to enable TLS/SSL? What are the security risks of a bad actor within the cloud provider trying to sniff our otherwise un-encrypted HTTP communication between node.js and mongo server.
We're considering adding a self-signed cert between the node and mongo machines. This will of course add some overhead to the communication.
Interested in hearing thoughts on best practice. Are you encrypting communications within the LAN on your cloud provider or is this overkill?
Correct me if I'm wrong but someone would need to basically snoop traffic at the internal router/switch level to eavesdrop.