<p>I want to use Kubernetes on some clouds (maybe Amazon, Google, etc). Should I disallow my EC2 machines from accessing the external network? My guess is as follows, and I wonder whether it is correct or wrong?</p>
<ol>
<li>I <em>should</em> disallow EC2 from accessing the external network. Otherwise, hackers can attack my machines more easily. (true?)</li>
<li>How to do it: I should use a dedicated load balancer (maybe Ingress) with the external IP that my domain name is bound to. The load balancer will then talk with my actual application (which has <em>no</em> external IP and can only access internal network). (true?)</li>
</ol>
<p>Sorry I am new to Ops, and thanks for any help!</p>

ch271828n
<p>Allowing or disallowing your EC2 instances from accessing external networks, ie keeping the rule that allows all outgoing traffic in your security group won't be of much use keeping hackers out, that's what the incoming traffic rules are for. It will, however, prevent unwanted traffic from going out <em>after</em> the hacker has reached your instance and has been able to install whatever malicious software on it, and then it would try to initiate outgoing communication.</p>
<p>That outgoing traffic rule is usually kept to allow things like getting software installs and updates, but it won't affect how your instances respond to incoming requests (legitimate or not).</p>
<p>It is a good idea to have a load balancer in front of your instances and have it be the only allowed point of entry to your services. It's a good pattern to follow, and your instances will not need to have an external IP address.</p>
<p>Having a bastion host is a good idea as well, and use it to manage the instances themselves. And I would also recommend Systems Manager's Session Manager for this task.</p>
