Reduce your AWS attack surface with port scanning

Step into the role of a security professional reviewing a small but realistic AWS environment: a containerized web app fronted by an Application Load Balancer, with a data tier and a leftover legacy bastion host. Using the AWS console and CloudShell, you map the environment's external attack surface with nmap and discover that two things answer the internet that never should, a database and cache tier exposed on ports 3306 and 6379, and a forgotten bastion with SSH wide open to the world. You then remediate each finding, replacing overly broad 0.0.0.0/0 rules with least-privilege security group design, including security group to security group references so the data tier only accepts traffic from the app tier, and narrowing remote access down to a known source instead of the entire internet. You re-scan after each change to prove the exposure is closed without breaking production, finishing with an environment where the load balancer is the only thing facing the internet.