Your current setup in AWS consists of the following architecture: 2 public subnets, one subnet with web servers accessed by users across the Internet and another subnet for the database server. Which of the following changes to the architecture would add a better security boundary to the resources hosted in this setup?

Answer options:

A.Consider moving the web server to a private subnet.
B.Create a private subnet and move the database server to a private subnet.
C.Consider moving both the web and database servers to a private subnet.
D.Consider creating a private subnet and adding a NAT Instance to that subnet.

Correct Answer – B
The ideal setup is to host the web server in the public subnet so that users on the Internet can access it. The database server can be hosted in the private subnet.
The below diagram from AWS Documentation shows the set up: