Security group as virtual firewall in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a security group that allows inbound SSH traffic.

AWS

resource "aws_security_group" "example" {
  name        = "example-sg"
  description = "Allow SSH inbound"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "[1]"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

Atcp

Budp

Cicmp

Dall

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'udp' instead of 'tcp' for SSH protocol.

Using 'all' which opens all protocols, not secure.

The protocol for SSH is TCP, so the correct value is tcp.

2fill in blank

medium

Complete the code to allow inbound HTTP traffic on port 80.

AWS

resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP inbound"

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "[1]"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

Aicmp

Budp

Ctcp

Dall

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'udp' which is incorrect for HTTP.

Using 'icmp' which is for ping and network diagnostics.

HTTP traffic uses TCP protocol on port 80, so the protocol must be tcp.

3fill in blank

hard

Fix the error in the security group rule that tries to allow all inbound traffic.

AWS

resource "aws_security_group" "open_sg" {
  name        = "open-sg"
  description = "Allow all inbound traffic"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "[1]"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

Drag options to blanks, or click blank then click option'

Atcp

Ball

Cany

D-1

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'all' or 'any' which are invalid protocol values.

Using 'tcp' which only allows TCP traffic.

To allow all protocols in AWS security groups, the protocol must be set to -1.

4fill in blank

hard

Fill both blanks to create a security group rule that allows inbound HTTPS traffic only from a specific IP range.

AWS

resource "aws_security_group" "secure_sg" {
  name        = "secure-sg"
  description = "Allow HTTPS inbound from office"

  ingress {
    from_port   = [1]
    to_port     = [2]
    protocol    = "tcp"
    cidr_blocks = ["203.0.113.0/24"]
  }
}

Drag options to blanks, or click blank then click option'

A443

B80

C22

D8080

Attempts:

3 left

💡 Hint

Common Mistakes

Using port 80 which is for HTTP, not HTTPS.

Using different values for from_port and to_port.

HTTPS uses port 443, so both from_port and to_port should be set to 443.

5fill in blank

hard

Fill all three blanks to define a security group that allows inbound TCP traffic on port 3306 from a specific subnet.

AWS

resource "aws_security_group" "db_sg" {
  name        = [1]
  description = "Allow MySQL inbound from subnet"

  ingress {
    from_port   = [2]
    to_port     = [3]
    protocol    = "tcp"
    cidr_blocks = ["10.0.1.0/24"]
  }
}

Drag options to blanks, or click blank then click option'

A"db-security-group"

B3306

D"database-sg"

Attempts:

3 left

💡 Hint

Common Mistakes

Using port 22 or 80 instead of 3306.

Not quoting the security group name.

The security group name should be a string like "database-sg". MySQL uses port 3306, so from_port and to_port are both 3306.