What must the database administrator do to finish providing connectivity to the reporting application?
Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432.
Add an outbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432.
Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on all TCP ports. Add an inbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432.
Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on all TCP ports.
Explanations:
Adding an inbound rule to the database security group for the developer VPC CIDR on port 5432 allows the reporting application to connect to the Aurora PostgreSQL database on the correct port. The outbound rule on the EC2 security group to allow access to the production VPC CIDR on port 5432 permits return traffic from the database. This follows AWS security best practices by restricting access to the necessary port only.
Outbound rules on both security groups are not sufficient for the reporting application to establish a connection, as there is no inbound rule on the database security group to accept traffic on port 5432.
Allowing inbound access to all TCP ports on the database security group from the developer VPC CIDR does not follow AWS security best practices, as it opens up unnecessary access to the database. Additionally, an inbound rule on the EC2 security group is not needed, as the EC2 instance initiates the connection.
Allowing outbound access on all TCP ports from the EC2 security group is unnecessary and does not follow AWS security best practices, as it opens up excessive access to the production VPC.
I draft that the answer is:
Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432.