I am creating a simple application so a distributed team can access sensitive data. This application will have a database that will be inaccessible to the public internet inside a VPC with my cloud provider. It will also have a web application inside this VPC that can access this database and accept incoming traffic from users. The web application will require users to authorize with MFA via a third party identity provider.
I am worried about opening this web application to all incoming HTTPS traffic in case the web application's authorization is somehow compromised. If we were all in a single office I could whitelist the office IP only, but we are a distributed team so maintaining a whitelist of all of the IPs of our users is impractical. I could also set up an ssh bastion and require my users to use ssh tunneling to access the application but the users will be non-technical so I feel it is unreasonable to expect them to do this.
After some research, I learned that I could set up a VPN and either whitelist the VPN's IP or connect the VPN to my VPC with my cloud provider. Either option will require users to log into the VPN before accessing the application. This seemed more secure to me at first glance but I realized that it is essentially requiring a second level of authorization that is no more or less secure than the web application's authorization.
Do you think the VPN layer is redundant? Does it provide enough extra security to justify the cost and hassle? I would also be open to other suggestions! Thanks.
[link] [comments]