Security groups

In 1 minute

A security group is a firewall attached to a network card. It lists what is allowed; everything else is dropped. MiniTickets has five groups that form a chain: only the internet may reach the ALB, only the ALB may reach the tasks, and only the api may reach Postgres and Valkey. Each link names the group before it as its source, not an IP address.

Picture it

flowchart TB
  NET((Internet)) -->|"443, 80"| ALBSG[alb-sg]
  ALBSG -->|"3000"| WEBSG[web-sg]
  ALBSG -->|"4000"| APISG[api-sg]
  APISG -->|"5432"| DBSG[db-sg]
  APISG -->|"6379"| REDISSG[redis-sg]

Each arrow is one inbound rule on the group it points to.

How it works

1. Inbound rules say who may connect in. Each rule has a protocol, a port and a source. The source is an address range (CIDR) or another security group.
2. A group as the source means “tasks that use that group”. Task IPs change on every restart; the group stays the same.
3. Security groups are stateful. If a request is allowed in, its reply is allowed out automatically. So db-sg needs no outbound rule to answer the api.
4. There is no “deny” rule. A packet that matches no rule is dropped silently. The caller sees a timeout, not an error.

In MiniTickets

How to read one rule, out loud: “minitickets-dev-db-sg has an inbound rule, TCP 5432, source minitickets-dev-api-sg.” That means only resources using the API security group can open a Postgres connection. The api tasks and the migration task use it.

Group	Inbound rules
alb-sg	TCP 443 and 80 from allowedCidrs (default 0.0.0.0/0)
web-sg	TCP 3000 from alb-sg; TCP 13000 from api-sg
api-sg	TCP 4000 from alb-sg; TCP 14000 from web-sg
db-sg	TCP 5432 from api-sg; no outbound rules
redis-sg	TCP 6379 from api-sg; no outbound rules

Ports 13000 and 14000 are the Service Connect proxies (see ECS on Fargate). The groups are made in infra/src/security.ts → createSecurityGroups.

See the database security group on the map →

See it in AWS

Console

EC2 → Security Groups → minitickets-dev-db-sg → Inbound rules: PostgreSQL, 5432, Source = the api group’s id.

CLI

aws ec2 describe-security-group-rules --filters Name=tag:Name,Values=minitickets-dev-db-in-5432

Code

infra/src/security.ts → createSecurityGroups

Break it

Symptom	Cause	Where to look
API log: timeouts to the database on 5432	db-sg’s rule names another source	db-sg → Inbound rules
Every /trpc/* call returns 504	api-sg has no TCP 4000 rule from alb-sg	api target group → Targets
https:// times out, http:// redirects	alb-sg has no TCP 443 rule	alb-sg → Inbound rules

Say it in an interview

Say it like this (20-30 seconds)

A security group is a stateful firewall on a network card that only lists what is allowed. Ours form a chain by referencing each other: the ALB group allows 443 from the internet, the api group allows 4000 only from the ALB group, and the database group allows 5432 only from the api group. Referencing groups survives changing task IPs. A missing rule shows up as a timeout, never as an error message.

Follow-ups

Why reference a group instead of the subnet's CIDR?

A CIDR like 10.0.0.0/16 allows every machine in the VPC, including ones that should never touch the database. A group reference allows exactly the tasks using that group.

How is a security group different from a network ACL?

A network ACL sits on a subnet, is stateless (replies need their own rule) and can deny. A security group sits on a network card, is stateful and only allows. MiniTickets uses the default ACLs and does all filtering with security groups.

What changes in CloudFront mode?

alb-sg then allows only TCP 80 from the AWS managed prefix list com.amazonaws.global.cloudfront.origin-facing, and a secret header on the listener proves the request came from our own distribution.

Why do db-sg and redis-sg have no outbound rules?

Postgres and Valkey never start a connection. Replies still flow because groups are stateful. An empty egress list means a compromised database cannot call out.

Advanced: Rule names and the CloudFront mode

Each rule is its own resource with a name like minitickets-dev-redis-in-6379, created with referencedSecurityGroupId. The ALB’s public rules live in infra/src/entry/alb-public-ingress.ts → createAlbPublicIngress and depend on the mode. The alb, web and api groups allow all outbound traffic, so the ALB reaches the tasks and the tasks reach AWS APIs.

Checkpoint

Answer these without scrolling up. If one feels hard, reread that section.

1. What does “stateful” mean for a reply from Postgres?
2. What does a caller see when no rule matches?
3. Read the db-sg rule out loud, with port and source.
4. Why are ports 13000 and 14000 open, and between which groups?
5. Which two pieces use the API security group?

Redraw it from memory: the chain of five security groups with the port on each arrow

Try this: on the map, select the API security group, turn on only the Security groups layer, and read its two inbound rules out loud

Mark this page as read