I have a web application launched using ElasticBeanstalk (EB) with load balancer, which instances may be added/removed based on the trigger.
Now I have a Redis server hosted on EC2 with port 6379 that I only want this very EB instances (all the instances launched by this EB) have access to that port.
EB has a security group (SG) called sg-eb and Redis has a SG called sg-redis.
All these are deployed under same VPC but may or may not be the same subnet.
How to I configure sg-redis so that all the instances under the EB have access to redis? I tried adding sg-eb to sg-redis allowing port 6379 but no luck. The only way I made it work was adding each instance's public IP to sg-redis so they have access. Though, if the load balancer adds/removes an instance, I'll need to manually configure sg-redis again.
Update #1
The Redis EC2 instance will have 2 IPs, one public and one private. You can find them when selecting the instance on the EC2 management console. Make sure you connect to that EC2 instance via this internal IP.
Related
I have AMI template server in EC2 AWS witch run my server.
For sure it's running in single VPC network.
I want to be able to connect any my server using ssh once it's running using hostname dns resolve.
For example I have gateway, server-01, server-02 in my ec2 instances list.
Once I launch one more server from my AMI (server-03), I need to connect to it from gateway server using ssh server-03
How I can do it?
I would suggest using terraform to manage your EC2 instances. This will allow you to do many things you would normally do manually.
You can have a private or public hosted zone assigned to your VPCs (public would require a bit more)
Then on terraform, you can have the following:
Your ec2 instance creation.
A tfvar file containing the variables for all your EC2 instances
Your Hosted Zone attaching the EC2 private IP to a DNS
Output afterwards to print out your new EC2 instance with the private DNS you can SSH to
I have 3 AWS Elastic Beanstalk instances which are running Spring microservices. All microservices are making POST requests to each other and using RDS service for database.
Should I isolate database traffic and microservices traffic into separate subnets?
In case it's a good practice is it possible to assign 2 private network IP's for each subnet for every AWS Elastic Beanstalk instance?
I think you cannot do it using EBS as the instances will auto create and terminate. So you should try to create instances separately and add autoscaling policy on it.
What I usually do is create my EC2 instances in Public subnet and RDS in private subnet and use RDS Security Group and add EC2 instance's Elastic IP, so that all the traffic is going through the EC2 instance and all the traffic coming to EC2 instance is HTTPS coming from ELB.
Adding the below steps as requested:
Ok, So I am assuming you already know a bit about how to create the servers and RDS etc.
Create an EC2 instance for each of your microservices.
Attach an EIP to each of these instances.
Add an Auto-Scaling policy to increase or decrease the instances based on the traffic/CPU Utilization. Make sure you terminate the newest created instance.
Add an ELB for this instance and add HTTPS/SSL certificate to secure your traffic.
Create RDS in a Private subnet and add instance EIP in RDS SG for 3306 port.
I think you should be able to do this then.
It's not a good practice to directly communicate between instances in EB. The reason is that that EB instances run in autoscalling group. So they can be terminated and replaced at any time by AWS leading to change in their private Ip addresses.
The change in IP will break your application sooner or later. Instances in EB should be accessed using Load Balancer or private IP.
So if you have some instances that are meant for private access only you could separate them to internal EB environment.
I believe that I've successfully setup an EBS instance and RDS instance in a VPC! It is structured like this:
Elastic load balancer: public available to the internet
Elastic instance: in private subnets
RDS instance: in private subnets
What can I do, both in AWS and outside through testing, to verify that my elastic instance is protected in the VPC and my RDS instance is as well?
Thank you so much!
You can verify the following:
ensure that SGs of the instances allow only incoming traffic from the SG of ALB.
ensure that the EB instances are in private subnet, i.e. they don't have public IP.
ensure that RDS has no public IP option enabled and also it is in private subnets.
also ensure that the SG of the RDS allows only incoming connections from the EB instances.
Adding on to #Marcin's comments, I would also do the below to ensure you are following best practises:
Enabling access logs on the ELB to have some sort of logs on who is accessing the ELB. Would definitely help in troubleshooting.
Have your ec2 in ASG.
Create a certificate and terminate the HTTPS connections on ELB or you can pass the HTTPS through and terminate the SSL on the ec2.
Redirect all requests from the http port to https using the redirect feature in ELB.
Now, to answer your question on how to test the security:
try to ssh into your ec2 directly. It should not work as you are only allowing traffic from ELB and your ec2 is in private subnets.
try accessing your RDS. It should not work as it will only allow traffic from EC2 security group
Build a bastion server (a blank ec2) on AWS and try to access the EC2. It should not work as the ec2 should only allow traffic from the ELB security group
using the bastion, try accessing RDS. Same as above, it should not work as it should only allow traffic from ec2 security group.
I have created a CloudFormation template and deployed it successfully. I have two EC2 Instances in SAME VPC, SAME SUBNET but different security group. One of the EC2 instance is MongoDB server installed on it, other one have the node server running. I am able to access both instances without any issue, problem happens when I try to connect to MongoDB from Node Server. It doesn't work. I have drilled down the issue that both the servers are not able to connect to each other. Below are my security group for
DB Server
Application Server
I have already visited below threads in this regards but it did not help.
EC2 instance can't connect to RDS, from same VPC/Subnet
CloudFormation - Security Group VPC issue
You aren't allowing outgoing traffic from your application server over port 12077. I would really recommend deleting all the SecurityGroupEgress rules and allowing the default of all egress allowed.
I have my MongoDB deployed in an EC2 instance, nice and steady. I will (hopefully) have my Elastic Beanstalk load-balanced Web App launched soon using Docker. However, I feel like my Database is too sensitive to dockerize or beastalk-ize, so I wanna keep it in a plain EC2 instance.
My issue is with regard to the security groups. How can I create a security group that will only accept MongoDB traffic (port 27017) from the Elastic Beanstalk? Since EC2 instances will get created and destroyed arbitrarily, maybe I can get the least-common subnet of those?
When you create your Elastic Beanstalk application, you will choose a security group to assign to it's EC2 instances.
For your MongoDB security group, allow traffic on port 27017 for the EB EC2's security group. If done this way, then only EC2 instances using that security group can access the MongoDB instance.
Note, when accessing your MongoDB instance from your EB app's EC2 instance, makes sure you use the private IP address of the MongoDB instance, and not the public IP address. If you use the public IP address, then AWS doesn't recognize the connection as originating from the EB security group and will deny the connection.