How can the Security Engineer protect this workload so that only employees can access it?
Add each employee’s home IP address to the security group for the application so that only those users can access the workload.
Create a virtual gateway for VPN connectivity for each employee, and restrict access to the workload from within the VPC.
Use a VPN appliance from the AWS Marketplace for users to connect to, and restrict workload access to traffic from that appliance.
Route all traffic to the workload through AWS WAF. Add each employee’s home IP address into an AWS WAF rule, and block all other traffic.
Explanations:
Adding each employee’s home IP address to the security group is impractical and inefficient, especially for remote workers who may have dynamic IP addresses or change locations frequently. This approach would require constant updates to the security group and does not provide a secure method for authenticating employees.
Creating a virtual gateway for VPN connectivity for each employee would require extensive management and scaling efforts, especially as the number of employees increases. Additionally, it does not provide a straightforward method to authenticate and authorize users accessing the workload.
Using a VPN appliance from the AWS Marketplace allows employees to securely connect to the AWS environment. This approach ensures that only authenticated employees can access the application by routing their traffic through the VPN, thereby restricting access to only those who are verified.
Routing all traffic through AWS WAF and blocking all other traffic based on IP addresses is not efficient, as it still requires maintenance of employee IP addresses and can be circumvented by employees using different locations or networks. AWS WAF is better suited for filtering malicious traffic rather than managing user access.
I surmise that the answer is:
Use a VPN appliance from the AWS Marketplace for users to connect to, and restrict workload access to traffic from that appliance.