How can i create an internal ELB with security groups? - amazon-web-services

Im using an internal ELB right now. Its only accessible from inside my VPCs which is good.
But now I want to add a security group to allow an external network access to the ELB. I could use a proxy server but I suspect there is a better way.
Can I create a public ELB and use security group to only allow it access to my VPC networks without hardcoding IPs? Is there a variable/placeholder i can use in a security group that says "all my connected vpcs"? Because then i could do that and just add an sg for that external network.

You can create an ELB and assign it a security group, then assign all resources you wish the ELB to be able to access a second security group, with a rule permitting access from the ELB's source security group.
See the ELB section of this guide

You can't assign access by specifying vpc- (how you might expect to, similar to being able to allow access based on other security groups by specifying the sg number, sg-..., under Source:).
However, it's easy enough to just put the subnets of your VPCs you want to allow access to and from. If your VPC is assigned the subnet of 10.10.0.0/16, specify that as a Source.
If you really want to have a single security group defined on your ELB for all of your VPCs, just create a stand-alone security group allowing access from all of your VPCs called vpc-access or something, and then assign that sg-... to your ELB Source: list.

Related

Add EC2s own IP as inbound rule using terraform

I have a license server that has a static IP set up inside the same security group and VPC as the EC2s I’m spinning up using terraform. Basically I want the license server and these EC2s to be able to communicate. At the moment they can’t because the security doesn’t add the EC2s as an inbound rule so that the license server also gets it as an inbound rule (same security group). I’m wondering how to add the IP of the EC2 I’m spinning up in terraform to the inbound of its security group so that it can talk to the license server?
There is no such concept as being "inside the same security group". Security Groups rules apply to each instance individually.
The correct configuration is:
Create a Security Group for the EC2 instances (EC2-SG) that permits appropriate Inbound access to use the instance, and
Create a Security Group for the licensing server (License-SG) that permits Inbound access on the licensing port from EC2-SG
That is, you need TWO security groups. License-SG will permit inbound access from any EC2 instance that has is associated with EC2-SG. You can have more security group as necessary for your instances -- simply add them as sources in License-SG.
Security Groups can also refer to themselves. In your current situation, where the instances and the licensing server are all associated with the same security group, you could add a rule that permits inbound connections from itself. However, this is also saying that the instances are permitting inbound connections from the licensing server, which would not be a correct configuration.
Please note that all communication within the VPC should take place via private IP addresses, otherwise the traffic exits the VPC and then comes in again, which does not allow Security Groups to operate correctly (and also costs you more money!).

How do I add a nested security group to another security Group and have it work with an Application loads balancer?

I have an ALB with a SG (ALB_SG) that I want to give access only to a list of IP's already defined in another SG (Whitelist_SG) in the same VPC.
I have created 2 (relevant) ingress rules for the ALB_SG.
443 ingress from Whitelist_SG
80 ingress from Whitelist_SG
In the Whitelist_SG I have a list of ingresses from relevant CIDR blocks that allow all ports.
When I access the ALB I am timing out (sign of bad SG). If I add the Whitelist_SG directly to the ALB it works.
What am I missing to make the nested rules work?
As an aside I know that when I add the Whitelist_SG to a EC2 instance via a nested rule I also have to add it to the instances Network adapter. I am assuming its something like that here.
AWS security groups don't work in the way you are trying to use them. There is no concept of "nesting" or "chaining" security groups like you are attempting.
The ability to reference one security group from another security group only works to allow members of one security group to access the members of the other security group. Security group membership only applies to resources like EC2 instances, Lambda functions, etc., that are running within your VPC (or a peered VPC).
For example, adding your laptop's IP address to security group A just gives your laptop access to anything security group A is directly attached to. It does not make your laptop a "member" of security group A.

Usage of ingress and egress rules between different EC2 instances

i have a jupyter notebook on one ec2 instance that want to get the data from data service that is deployed on other ec2 instance. should i put ingress and egress rules for each other on both instances? I'm quite new on the field, so any explanations are appreciated! :)
Yes, you can create 2 different security groups and attach to each one.
You can allow inbound traffic from a particular security group, all instances that have the security group attached can send traffic to the instance on the port you specify.
Another important thing no notice is that security groups are stateful, when you set outbound rules the response traffic is allowed regardless of the inbound rules.
Security Group Outbound rules allow all traffic by default. Typically, you should not modify these settings.
The best way to configure you setup is:
Create a Jupyter-SG security group and associate it with your Jupyter EC2 instance. Add whatever rules you use to connect with the instance (eg SSH).
Create a Data-SG security group and associate it with your "Data Service" EC2 instance. Add a rule permitting inbound access on the desired port, with Source set to the Security Group ID of Jupyter-SG.
This tells the Data-SG security group to permit inbound access from the Jupyter instance (or, more accurately, from any instance that is associated with the Jupyter-SG security group).

How to give a VPC and all its instances access to a AWS Security Group

My goal is simple:
Allow any instance inside a VPC to connect to a specific security group.
The field for allowed sources suggests: "CIDR, IP or Security group".
Is there a way for me to specify a VPC?
The reason beeing that I have multiple instances inside a VPC with different security groups but all need access to the security group I am creating.
Your VPC has a CIDR group range, so just specify the CIDR group that is being used by your VPC and it will allow access from anything in the VPC.
What you are asking is the primary functionality of a security group. For example, if the CIDR of the VPC you want to allow is 10.4.0.0/16,
Set the Inbound route to the required CIDR group. The Outbound will automatically be set as per AWS VPC design.

AWS: How to allow all TCP traffic between all instances in same VPC?

I am setting up EMR clusters on demand, and have a windows EC2 server as a workstation, and a linux EC2 server as a secondary server. All in the same VPC. I would like to avoid having to set security group rules each time an instances comes up with a new IP.
How would I simply allow any traffic to flow freely between all servers in the same VPC?
Thanks!
EDIT- Thanks for the replies, I know this is not good practice in production, but we are dealing with some issues tracking down functionality which we believe is caused by ports, this is just a exploration phase, and this will help us. Thanks!
In the security groups, assign incoming access to other security groups by specifying a security group ID instead of IP addresses. In the web console, if you start typing "sg" in the source field it will pop up a list of your security groups to choose from. Using a security group ID as the source allows all resources that belong to that security group to have access.
Alternatively, if you just want one rule that allows access to every resource in your VPC you would specify your VPC's IP range.
to Allow any traffic between ALL servers in the VPC is not a good practice.
you should rethink in your VPC purpose.
Any way, if you want a group of servers to communicate with each other you can create a Security Group
And Assign it for all servers that you want.
and in inbound rules you add one rule from type "All TCP" and the source of this rule will be the same Security Group.
if your Security Group ID is 'sg-xxxxxxxx'
then the rule will be like this:
All TPC | TCP | 0-65535 | custom | sg-xxxxxxxx
To add to the other answers here, if you really want this, you can set it up via the Subnet or VPC IP CIDR Block
For example, if your VPC is 10.0.0.0/16, then add that to your security groups and all VPC traffic should be able to flow to each other.