RDS security (encryption, security groups) in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption for the RDS instance.

AWS

resource "aws_db_instance" "example" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  name                 = "mydb"
  username             = "admin"
  password             = "password"
  parameter_group_name = "default.mysql8.0"
  storage_encrypted    = [1]
}

Drag options to blanks, or click blank then click option'

Atrue

Bfalse

C"yes"

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Using string values like "yes" instead of boolean true.

Setting encryption to false or 1 which are incorrect types.

Setting storage_encrypted to true enables encryption for the RDS instance storage.

2fill in blank

medium

Complete the code to allow inbound MySQL traffic on port 3306 in the security group.

AWS

resource "aws_security_group_rule" "mysql_inbound" {
  type              = "ingress"
  from_port         = 3306
  to_port           = 3306
  protocol          = "[1]"
  security_group_id = aws_security_group.db_sg.id
  cidr_blocks       = ["0.0.0.0/0"]
}

Drag options to blanks, or click blank then click option'

Aicmp

Budp

Ctcp

Dhttp

Attempts:

3 left

💡 Hint

Common Mistakes

Using UDP or ICMP which are not used by MySQL.

Using 'http' which is not a protocol value.

MySQL uses TCP protocol on port 3306, so the protocol must be set to tcp.

3fill in blank

hard

Fix the error in the security group rule to restrict access only from a specific IP.

AWS

resource "aws_security_group_rule" "restricted_access" {
  type              = "ingress"
  from_port         = 5432
  to_port           = 5432
  protocol          = "tcp"
  security_group_id = aws_security_group.db_sg.id
  cidr_blocks       = ["[1]"]
}

Drag options to blanks, or click blank then click option'

A0.0.0.0/0

B192.168.1.100/32

C192.168.1.0

D255.255.255.255

Attempts:

3 left

💡 Hint

Common Mistakes

Using 0.0.0.0/0 which allows all IPs.

Using IP without CIDR mask or invalid CIDR.

To restrict access to a single IP, use the IP address with a /32 mask, like 192.168.1.100/32.

4fill in blank

hard

Fill both blanks to create a security group rule that allows inbound HTTPS traffic only from a specific security group.

AWS

resource "aws_security_group_rule" "https_inbound" {
  type                     = "ingress"
  from_port                = 443
  to_port                  = 443
  protocol                 = "tcp"
  security_group_id        = aws_security_group.app_sg.id
  [1]               = aws_security_group.web_sg.id
  [2]               = []
}

Drag options to blanks, or click blank then click option'

Asource_security_group_id

Bcidr_blocks

Cipv6_cidr_blocks

Ddescription

Attempts:

3 left

💡 Hint

Common Mistakes

Using cidr_blocks with IP ranges instead of security group ID.

Leaving cidr_blocks undefined or non-empty.

To allow traffic from another security group, use source_security_group_id with the group's ID, and set cidr_blocks to an empty list to avoid conflicts.

5fill in blank

hard

Fill all three blanks to define an encrypted RDS instance with a security group allowing inbound traffic only from a trusted IP range.

AWS

resource "aws_db_instance" "secure_db" {
  allocated_storage    = 50
  engine               = "postgres"
  instance_class       = "db.t3.medium"
  name                 = "securedb"
  username             = "admin"
  password             = "securepass"
  storage_encrypted    = [1]
  vpc_security_group_ids = [[2]]
}

resource "aws_security_group" "db_sg" {
  name        = "db_sg"
  description = "Allow trusted IPs"
  vpc_id      = "vpc-123456"
}

resource "aws_security_group_rule" "trusted_ip_rule" {
  type              = "ingress"
  from_port         = 5432
  to_port           = 5432
  protocol          = "tcp"
  security_group_id = aws_security_group.db_sg.id
  cidr_blocks       = ["[3]"]
}

Drag options to blanks, or click blank then click option'

Atrue

Baws_security_group.db_sg.id

C10.0.0.0/24

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Setting encryption to false or a string.

Using security group name instead of ID.

Using invalid CIDR notation or open IP ranges.

Encryption is enabled by setting storage_encrypted to true. The RDS instance must reference the security group ID in vpc_security_group_ids. The security group rule restricts access to the trusted IP range 10.0.0.0/24.

Practice

1. What does enabling storage_encrypted on an AWS RDS instance do?

easy

A. It encrypts the data stored on the disk to protect it at rest.

B. It encrypts data only during transfer between client and database.

C. It automatically backs up the database to another region.

D. It restricts access to the database based on IP addresses.

Solution

1. Step 1: Understand storage encryption purpose

   Storage encryption protects data saved on disk, making it unreadable without keys.

2. Step 2: Differentiate encryption types

   Encryption at rest means data on disk is encrypted; encryption in transit protects data moving over network.

3. Final Answer:

   It encrypts the data stored on the disk to protect it at rest. -> Option A

4. Quick Check:

   Storage encryption = data safe at rest [OK]

Hint: Storage encryption means data on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking storage_encrypted controls network access
• Assuming it automatically backs up data

2. Which of the following is the correct way to allow inbound traffic on port 3306 (MySQL) in an RDS security group?

easy

A. Allow inbound ICMP traffic on port 3306 from 0.0.0.0/0.

B. Allow outbound UDP traffic on port 3306 to any IP.

C. Allow inbound TCP traffic on port 3306 from the required IP range.

D. Allow inbound TCP traffic on port 22 from the required IP range.

Solution

1. Step 1: Identify correct protocol and port for MySQL

   MySQL uses TCP protocol on port 3306 for inbound connections.

2. Step 2: Confirm security group rule for inbound access

   Security groups must allow inbound TCP traffic on port 3306 from trusted IPs to permit database access.

3. Final Answer:

   Allow inbound TCP traffic on port 3306 from the required IP range. -> Option C

4. Quick Check:

   Inbound TCP 3306 = MySQL access allowed [OK]

Hint: Inbound TCP on port 3306 opens MySQL access [OK]

Common Mistakes:

• Using wrong protocol like UDP or ICMP
• Allowing outbound instead of inbound traffic
• Opening port 22 (SSH) instead of 3306

3. Given this security group rule for an RDS instance:
Inbound: TCP, Port 5432, Source: 192.168.1.0/24
Which client IP can connect successfully?

medium

A. 192.168.1.50

B. 192.168.2.10

C. 10.0.0.5

D. 172.16.0.1

Solution

1. Step 1: Understand CIDR range 192.168.1.0/24

   This range includes all IPs from 192.168.1.0 to 192.168.1.255.

2. Step 2: Check which IP falls inside this range

   192.168.1.50 is inside the range; others are outside.

3. Final Answer:

   192.168.1.50 -> Option A

4. Quick Check:

   192.168.1.0/24 includes 192.168.1.50 [OK]

Hint: Check if IP fits CIDR range to allow connection [OK]

Common Mistakes:

• Not understanding CIDR notation
• Assuming any 192.168.x.x IP is allowed
• Confusing inbound and outbound rules

4. You created an RDS instance with storage_encrypted: true but the console shows encryption as disabled. What is the likely cause?

medium

A. Encryption can only be enabled after instance creation.

B. The security group does not allow inbound traffic on the database port.

C. The IAM role lacks permissions to enable encryption.

D. The RDS instance was created from a snapshot that was not encrypted.

Solution

1. Step 1: Understand encryption behavior on RDS creation

   Encryption must be enabled when creating the instance or from an encrypted snapshot.

2. Step 2: Identify snapshot encryption impact

   If created from an unencrypted snapshot, encryption cannot be enabled later.

3. Final Answer:

   The RDS instance was created from a snapshot that was not encrypted. -> Option D

4. Quick Check:

   Unencrypted snapshot blocks encryption [OK]

Hint: Encryption depends on snapshot encryption at creation [OK]

Common Mistakes:

• Thinking encryption can be toggled anytime
• Confusing security group issues with encryption status
• Assuming IAM permissions control encryption flag

5. You want to secure an RDS instance so only your application servers in a private subnet can connect, and data is encrypted at rest. Which combination is best?

hard

A. Disable encryption and allow inbound from 0.0.0.0/0 for easy access.

B. Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only.

C. Enable encryption but allow inbound from all IPs to avoid connection issues.

D. Use a public subnet for RDS and restrict access by username only.

Solution

1. Step 1: Enable storage encryption for data safety

   Setting storage_encrypted ensures data is encrypted at rest.

2. Step 2: Restrict access via security group to private subnet

   Allowing inbound only from private subnet CIDR limits access to trusted app servers.

3. Final Answer:

   Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only. -> Option B

4. Quick Check:

   Encryption + restricted SG = secure RDS [OK]

Hint: Encrypt data and restrict SG to private subnet [OK]

Common Mistakes:

• Allowing open access (0.0.0.0/0) to RDS
• Disabling encryption for convenience
• Using public subnet exposing RDS to internet