# Exercise 1 — Designing a Ruleset for a Three-Tier App

## Scenario

You're setting up firewall rules (as cloud security groups) for a three-tier application: a public-facing load balancer, a private application server tier, and a private database tier. Requirements:

- The public internet must be able to reach the load balancer on HTTPS only.
- The load balancer must be able to reach the app servers on port 8080.
- The app servers must be able to reach the database on port 5432.
- Engineers need SSH access to app servers, but only from the internal office network `198.51.100.0/24`.
- Nothing else should be reachable, in either direction, anywhere.

## Deliverables

1. **Security group table.** For each of the 3 tiers (load balancer, app, database), list every ingress rule needed: source, protocol, port. State explicitly that these are stateful groups (per theory section 5), so return traffic needs no separate rule.

2. **Default policy statement.** State what the default policy is for traffic matching none of your rules, and justify it against theory section 4.

3. **Egress reasoning.** For the database tier specifically, decide what (if anything) its egress rules should allow, and justify your choice using theory section 3's point about egress limiting a compromised host's blast radius — assume the database tier has no legitimate reason to initiate outbound connections to the public internet.

4. **Catch the mistake.** A colleague proposes adding `ALLOW from 0.0.0.0/0 to app-tier, TCP, port 8080` "to make testing easier while we debug the load balancer." Explain specifically what this rule exposes that shouldn't be, and propose the narrower rule that achieves the same debugging goal without it.