Ingress to the database is open from 0.0.0.0/0 on all ports

[alexpulver]

Is there a reason to open ingress to the database from 0.0.0.0/0 on all ports? It doesn't seem to be needed, since there is an explicit reference to yelb-app-server security group.

aws-app-mesh-examples/blogs/ecs-service-connectivity/yelb/deployments/platformdeployment/AWS/ECS/yelb-cloudformation-ECS-AppMesh-deployment.yaml

Lines 517 to 530 in 1970235

	YelbDbSecurityGroup:
	Type: AWS::EC2::SecurityGroup
	Properties:
	GroupDescription: yelb-db security group
	SecurityGroupIngress:
	- SourceSecurityGroupId: !Ref YelbAppserverSecurityGroup
	IpProtocol: tcp
	ToPort: 5432
	FromPort: 5432
	- CidrIp: 0.0.0.0/0
	IpProtocol: tcp
	ToPort: 65535
	FromPort: 0
	VpcId: !Ref 'VPC'

[ganeshbch]

This could be a good resource https://www.stratoscale.com/blog/cloud/aws-security-groups-5-best-practices/ to resolve the issue.

[bcelenza]

@alexpulver You are correct, allowing all is not required for that security group. I'm currently working with the blog owner to correct that and a few other issues with this example.

[alexpulver]

@rajal-amzn @herrhound @jamsajones @bcelenza any chance this code can be updated?