I'm having an issue with Security Groups in AWS. I have 4 security groups, 2 in EC2 and 2 in RDS.
ec2-prod
ec2-test
rds-prod
rds-test
On the other hand, I have a database DEV, having the rds-test security group associated.
In the rds-test inbound rules I've added ec2-prod and ec2-test, and my IP is added into the ec2-test, but for some reason it's not working.
If I add my IP directly on rds-test I can connect to the database, but this behavior make no sense to me.
Just in case, in the ec2-test security group, my IP has permission ALL TCP.
Any ideas?
It's the normal behavior. You have to add your IP to the DB security group.
The DB security group defines the access the RDS DB.
The EC2 security group defines the access the EC2 instance.
The fact that your IP is authorized to access the instance doesn't mean your IP is authorized to access the DB (but you can connect to the DB from the instance).
Related
I am trying to understand this statement:
"You can reference AWS Security Groups from other Security Groups."
What exactly does this mean?
This is how I understood this. I created a security group and call it "SG-10" and attached it to an instance "EC2-10". The SG "SG-10" has allow port 443 defined inside it.
Now, I create a security group and call it "SG-20" and attached this to an instance "EC2-20". This also has port 443 allowed. Now, if I call "SG-10" inside "SG-20" does this mean that "EC2-10" will be able to connect to "EC2-20" on port 443.?
Regards,
Nik.
if I call "SG-10" inside "SG-20"
No, you can not call a security group, this does not make any sense.
If a security group A references security group B, it does mean that the instance to which the security group A is attached allows inbound or outbound traffic to another instance to which security group B is attached. But if you want to send traffic form instance with security group A to the instance with security group B, you have to use the IP or the DNS of the instance B.
Usually the reason why we would want to reference a security group instead of an IP, is that the IP might change over time or it is not exposed at all. A fairly common example is having an application load balancer (ALB) and a group of EC2 instances which allow traffic only from the ALB. The IP address of the ALB changes over time, so in order to be able to receive traffic from the ALB, we can reference the security group attached to it.
In we want to reference a security group from another security group, we have to edit the rules of the initial security group:
As an example of referencing security groups, imagine a 3-tier architecture:
A Load Balancer receiving traffic from the Internet and sending requests to an Amazon EC2 instance
An Amazon EC2 instance receiving requests from the Load Balancer and sending queries to an Amazon RDS database
An Amazon RDS database receiving requests from the EC2 instance
This would involve 3 security groups:
A security group on the Load Balancer (LB-SG) that allows incoming traffic on port 80/443.
A security group on the EC2 instance (App-SG) that allows incoming traffic on port 80 only from the load balancer. It does this by setting the source to LB-SG.
A security group on the RDS database (DB-SG) that allows incoming traffic on the relevant port (eg 3306) only from the EC2 instance. It does this by setting the source to App-SG.
All security groups allow All Outbound Traffic.
By referencing other security groups, resources can be added/removed without having to change the security groups. For example, another EC2 instance could be launched and assigned the App-SG security group. This new instance would then be able to communicate with the database since DB-SG allows incoming traffic from App-SG, without being tied to any specific IP addresses.
If a resource is associated with multiple security groups, then all rules apply to the resource. Security Groups only say what is 'Allowed'. They do not include 'Deny' rules.
In your SG-10/SG-20 example, you do not mention the source of the traffic, so it is not possible to answer your question. If you want EC2-20 to accept connections from EC2-10, then the SG-20 security group should allow connections with the Source set to SG-10.
As an aside, I should mention that Network ACLs should normally be left at their default "Allow All" settings unless there is a specific networking requirement (eg creating a DMZ).
I've been burned on this before by trying to connect to an EC2 instance's public address... sounds very similar to your setup. Please check this question: Source Security group isnt working as expected in aws. Actually. When you wire up the inbound rule so that the source is a security group, you must communicate through the source instance's private address.
I removed security groups for RDS, left access only for my IP. But access from EC2(ECS Fargate) still exists. Where I do have to look in order to fix it?
UPD:
I removed security groups from Connectivity tab in RDS > Databases Modify DB instance: ****
UPD2:
I have only one group: DevGroup
with only one rule
MYSQL/Aurora TCP 3306 x.x.x.x/32 (my home IP)
The problem was that removing the security group from RDS didn't immediately affect it. After while access has gone.
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.Scenarios.html#USER_VPC.Scenario1
Instances in the same VPC have access there is no need to configure security groups there
I cannot connect to my rds instance from ec2 instance, the error I am getting is connect: connection timed out. However, I am able to connect from mysql workbench running on my local machine.
RDS instance set to publicly available
RDS instance and ec2 instance are in the same security group
Security group when configured to allow connections from anywhere still produces same error
traceroute outputs *** for all when run from ec2 to rds, however provides normal output when run from local machine provides output showing that it's not blocked by firewall
RDS instance and ec2 instance are in same availability zone, not multi-zone rds
Opening the connection using the following golang:
conn, err = sql.Open("mysql", fmt.Sprintf("%s:%s#tcp(%s:%s)/%s", os.Getenv("db_user"), os.Getenv("db_pass"), os.Getenv("db_endpoint"), os.Getenv("db_port"), os.Getenv("db_name")) + "?parseTime=true")
It seems like a firewall issue but changing security group permissions is not helping.
Putting resources in the same security group does not grant access between those resources. This is because the security group rules are applied to each resource individually. Therefore, the security group would need to "allow access from itself" to permit the connection. However, since your RDS database is configured for public access, this won't actually work because the RDS database will have a public IP address.
Given that your database is publicly accessible, its DNS name will resolve to a public IP address. Therefore, your configuration should be:
Create a security group for the Amazon EC2 instance (App-SG) that permits appropriate Inbound permissions (eg HTTP, SSH) and has default Outbound rules (Allow All)
Create a security group for the Amazon RDS database (DB-SG) that permits inbound access from the EC2 instance's public IP address
If, however, the RDS database was not configured for public access, you would configure the security group to permit inbound access from App-SG. That is, the DG-SG would specifically refer to App-SG.
I have set an Amazon EC2 instance and an Amazon RDS instance. These two instances are both available.
I tried to connect to the RDS instance from my localhost, and I succeeded:
(I'm sorry about the picture's content is in Chinese, but the content in the red border means "success".)
In a word, when I used my localhost, I can connect to the RDS instance that I just set successfully.
But when I tried to use the EC2 instance to connect the same RDS instance with oracle sqldeveloper, I CANNOT EVEN CONNECT TO IT.
The error message is:
The Network Adapter could not establish the connection
How can I solve this issue?
Update:
My Security Group is:
The security groups match the AWS EC2 instance`s PRIVATE IP.
This answer is not necessarily a fix for your situation, but rather a recommendation about how to configure a security group.
Rather than using IP addresses within a security group, it is better to refer to another security group.
The configuration would be:
EC2-SG security group: Attach this to your EC2 instance. Allow access on desired ports (eg port 80).
RDS-SG security group: Attach this to your RDS instance. Allow access from EC2-SG- on desired port (eg port 3306).
This way, the RDS-SG will permit access from any EC2 instance associated with the EC2-SG security group. This will continue to work even if IP addresses change or additional EC2 instances are launched with the same EC2-SG.
I have a t2.micro instance running, that is producing some data that needs to be written to a database. So, I created a RDS database with MySQL on it.
The issue I'm facing is, nonsurprisingly, getting the EC2 instance to communicate with the RDS database in any way/shape/form.
I'm been battling with it all day. I'm left with these bits of confusion:
I figured I've just add the public IP of the EC2 instance to the security group of the RDS. Turns out the RDS doesn't really have a security group, only a VPN. So how do I allow communication from the EC2 instance, then?
Speaking of security groups, do I need to se the EC2 up to require outbound connections?
The RDS has an 'endpoint' and not a public IP as far as I can tell. So I can't add it to any security group at all. Is this correct?
Am I going to have to figure out how to use Elastic Beanstalk or some other way to get these components to play together?
These are all the things I'm trying to troubleshoot but I'm not getting anywhere. There doesn't seem to be any good blogs / etc; mostly what I'm finding is stuff on how to get the RDS to be accessed by your local hardware, not an EC2 instance.
How should I set this up?
There are two ways to allow inbound connection to RDS database: CIDR/IP or EC2 security group.
You can go to VPC, at the left panel there is "Security Groups" (yes, RDS do have security group). Click that, and choose your DB security group (if you already have the RDS instance created) or create a new one.
Under connection type, choose either CIDR/IP or EC2 security group.
If you choose to go with CIDR/IP, you should know what IP address your EC2 instance is and put the address or range in e.g. "10.11.12.0/24".
If you choose to go with EC2 security group, you should know the security group nameof your EC2 instance and select it from the dropdown provided e.g. "my security group".
Please note that the EC2 instance and the RDS instance need to be able to "see" each other i.e. in the same region, VPC, subnets with proper NACL (network access control list) etc.
Speaking of outbound connection and security group, no, security groups only manage inbound connection.
Hope that helps, let me know if I can make my answer clearer.