如果前端调用API时显示IPv4公网IP，请问这个后端是否存在安全问题？

Question

Now, I am using ec2 as the backend platform (node js + nginx + certbot), and the settings of nginx.conf are as follows

server {
  listen 80;
  server_name somethings.example.com;
  root         /usr/share/nginx/html;
  location /{
     proxy_pass http://127.0.0.1:3000;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection 'upgrade';
     proxy_set_header Host $host;
     proxy_cache_bypass $http_upgrade;
     proxy_redirect off;
  }

frontend-backend communicate via https

When the front end uses the backend (api), in the chrome devtool ("Elements" panel), you can see the ec2 IPv4 public IP: 433 in the "Remote Address" column

problem

However, when I use IPv4 public IP: 3000, I can use http (insecure) api (currently using 404 to prevent further use)

So I want to ask if this will cause security problems? How to solve it? Or redirect when using http for communication? Or how to hide the ec2 IPv4 public IP:433 in the remote address?

Answer 1

Yes, there are security issues. Exposing your EC2 instances on public subnets allows folks to try and probe the various ports and see if they can exploit any vulnerabilities or take advantage of any lax in security.

At the very minimum, you should lock down the security group associated with this EC2 instance to ensure it's only accepts public HTTP traffic from the expected 443 port.

One common way to improve security would be to use a load balancer (even if you only have a single EC2 instance).

Amazon provides a variety of load balancers and you could use the classic Elastic Load Balancer (ELB) or Application Load Balancer (ALB).

This works by putting your EC2 instance in a private subnet so that things on the internet can not get access to it. You then create the load balancer in the public subnet and update the security group settings so that only the load balancer can send requests to the EC2 instances. You can also make sure that the load balancer only accepts/forwards HTTPS traffic.

Using the above strategy hides the EC2 instance from clients and makes sure that no one can probe the various ports of your EC2s.

Without this, you'll just have to rely on locking down the security group settings on your EC2 to ensure only the excepted ports are open to the public.