Security group `sg-db` in VPC B has an inbound rule that allows TCP 5432 from security group `sg-app` in VPC A. VPC A and VPC B are connected only by an active VPC peering connection (there is no transit gateway involved). Which statement is correct about this rule?
- The rule works: instances in sg-app can reach port 5432 on instances in sg-db using sg-app instances' private IP addresses, and none of sg-app's own rules are imported into sg-db as a result
- The rule is invalid, because a security group rule can only reference another security group when both are in the same VPC
- The rule works only if every instance in sg-app also has its public IP address individually added to sg-db
- Creating this rule automatically also permits sg-db instances to initiate connections to sg-app on any port
Why A? And why not the others?
Correct answer: A. The rule works: instances in sg-app can reach port 5432 on instances in sg-db using sg-app instances' private IP addresses, and none of sg-app's own rules are imported into sg-db as a result
AWS explicitly supports cross-VPC security group referencing for inbound rules 'if... there is a peering connection between the VPCs that the security groups are associated with' (also via a shared transit gateway), so this rule is valid and lets sg-app's instances reach sg-db's instances on 5432 using their private IPs; AWS also states 'no rules from the referenced security group are added to the security group that references it,' so sg-app's own rule set is not imported. Option B is wrong because same-VPC is only one of three documented conditions that make a reference valid — an active peering connection is another. Option C is wrong because security-group referencing is resolved by private IP addresses of the referenced group's instances automatically; manually enumerating public IPs isn't how the feature works and would defeat its purpose. Option D is wrong because referencing a security group in one rule creates only that one-directional permission; it neither reciprocates access in the opposite direction nor imports any rules from the referenced group.
Source: AWS VPC docs: Security group rules — Security group referencing