So for reasons Id rather not go into, my DB is on an EC2 instance in eu-west-1 and I have created a beanstalk app on us-east-1. Id like my app to talk to that EC2 instance on a MySQL port (3306).
Can anyone assist with how Id set this up, what ingress rules I need to setup on the EC2 security group? Given that I will have multiple versions of the app in beanstalk, the IP address may change regularly (after environment rebuilds etc).
The important concept regarding Security Group Rules you might be missing is, that you do not necessarily specify IP addresses as traffic sources alone, rather regularly will refer to other security groups as well:
The source can be an individual IP address (203.0.113.1), a range of
addresses (e.g., 203.0.113.0/24), or an EC2 security group. The
security group can be another group in your AWS account, a group in
another AWS account, or the security group itself.
By specifying a security group as the source, you allow incoming
traffic from all instances that belong to the source security group.
[...] You might specify another security group in your account if you're creating a
three-tier web service (see Creating a Three-Tier Web Service).
[emphasis mine]
Consequently you'll simply need to add the Beanstalk app instances security group as a traffic source for TCP port 3306 within the MySQL instance security group.
Taking this further
An additional concept to make oneself familiar with is, that you can have multiple security groups assigned to an instance, thus enabling (possibly dynamic) composition of the resulting firewall.
For example, a recommended practice for larger architectures suggests to specify a dedicated security group per 'role' your instances have (rather than accumulating several rules within one security group as usual), e.g. we have security groups like 'role-ssh' (TCP port 22) and 'role-mysql' (TCP port 3306), which are assigned to EC2 instances as needed in turn. You can read more about this concept in e.g. Security Groups - Most Underappreciated Feature of Amazon EC2.
Related
I have a license server that has a static IP set up inside the same security group and VPC as the EC2s I’m spinning up using terraform. Basically I want the license server and these EC2s to be able to communicate. At the moment they can’t because the security doesn’t add the EC2s as an inbound rule so that the license server also gets it as an inbound rule (same security group). I’m wondering how to add the IP of the EC2 I’m spinning up in terraform to the inbound of its security group so that it can talk to the license server?
There is no such concept as being "inside the same security group". Security Groups rules apply to each instance individually.
The correct configuration is:
Create a Security Group for the EC2 instances (EC2-SG) that permits appropriate Inbound access to use the instance, and
Create a Security Group for the licensing server (License-SG) that permits Inbound access on the licensing port from EC2-SG
That is, you need TWO security groups. License-SG will permit inbound access from any EC2 instance that has is associated with EC2-SG. You can have more security group as necessary for your instances -- simply add them as sources in License-SG.
Security Groups can also refer to themselves. In your current situation, where the instances and the licensing server are all associated with the same security group, you could add a rule that permits inbound connections from itself. However, this is also saying that the instances are permitting inbound connections from the licensing server, which would not be a correct configuration.
Please note that all communication within the VPC should take place via private IP addresses, otherwise the traffic exits the VPC and then comes in again, which does not allow Security Groups to operate correctly (and also costs you more money!).
I am trying to understand this statement:
"You can reference AWS Security Groups from other Security Groups."
What exactly does this mean?
This is how I understood this. I created a security group and call it "SG-10" and attached it to an instance "EC2-10". The SG "SG-10" has allow port 443 defined inside it.
Now, I create a security group and call it "SG-20" and attached this to an instance "EC2-20". This also has port 443 allowed. Now, if I call "SG-10" inside "SG-20" does this mean that "EC2-10" will be able to connect to "EC2-20" on port 443.?
Regards,
Nik.
if I call "SG-10" inside "SG-20"
No, you can not call a security group, this does not make any sense.
If a security group A references security group B, it does mean that the instance to which the security group A is attached allows inbound or outbound traffic to another instance to which security group B is attached. But if you want to send traffic form instance with security group A to the instance with security group B, you have to use the IP or the DNS of the instance B.
Usually the reason why we would want to reference a security group instead of an IP, is that the IP might change over time or it is not exposed at all. A fairly common example is having an application load balancer (ALB) and a group of EC2 instances which allow traffic only from the ALB. The IP address of the ALB changes over time, so in order to be able to receive traffic from the ALB, we can reference the security group attached to it.
In we want to reference a security group from another security group, we have to edit the rules of the initial security group:
As an example of referencing security groups, imagine a 3-tier architecture:
A Load Balancer receiving traffic from the Internet and sending requests to an Amazon EC2 instance
An Amazon EC2 instance receiving requests from the Load Balancer and sending queries to an Amazon RDS database
An Amazon RDS database receiving requests from the EC2 instance
This would involve 3 security groups:
A security group on the Load Balancer (LB-SG) that allows incoming traffic on port 80/443.
A security group on the EC2 instance (App-SG) that allows incoming traffic on port 80 only from the load balancer. It does this by setting the source to LB-SG.
A security group on the RDS database (DB-SG) that allows incoming traffic on the relevant port (eg 3306) only from the EC2 instance. It does this by setting the source to App-SG.
All security groups allow All Outbound Traffic.
By referencing other security groups, resources can be added/removed without having to change the security groups. For example, another EC2 instance could be launched and assigned the App-SG security group. This new instance would then be able to communicate with the database since DB-SG allows incoming traffic from App-SG, without being tied to any specific IP addresses.
If a resource is associated with multiple security groups, then all rules apply to the resource. Security Groups only say what is 'Allowed'. They do not include 'Deny' rules.
In your SG-10/SG-20 example, you do not mention the source of the traffic, so it is not possible to answer your question. If you want EC2-20 to accept connections from EC2-10, then the SG-20 security group should allow connections with the Source set to SG-10.
As an aside, I should mention that Network ACLs should normally be left at their default "Allow All" settings unless there is a specific networking requirement (eg creating a DMZ).
I've been burned on this before by trying to connect to an EC2 instance's public address... sounds very similar to your setup. Please check this question: Source Security group isnt working as expected in aws. Actually. When you wire up the inbound rule so that the source is a security group, you must communicate through the source instance's private address.
I've followed https://docs.gitlab.com/runner/configuration/runner_autoscale_aws_fargate/ to create a custom runner which has a public IP attached and sits in a VPC alongside "private" resources. The runner is used to apply migrations using gitlab ci/cd.
ALLOW 22 0.0.0.0/0 has been applied within the security group; but it's wide open to attacks. What IP range do I need to add to only allow gitlab ci/cd runners access via SSH? I've removed that rule for the moment so we're getting connection errors, but the IPs connecting on port 22 all come from AWS (assuming gitlab runners are also on AWS).
Is there something I'm missing or not understanding?
I had a look at the tutorial. you should only allow EC2 instances to be able to ssh into the Fargate tasks.
One way to do that is, You could define EC2 instance's security group as the source in the Fargate task's security group instead of using an ip address(or CIDR block). You don't have to explicitly mention any ip ranges. This is my preferred approach.
When you specify a security group as the source for a rule, traffic is allowed from the network interfaces that are associated with the source security group for the specified protocol and port. Incoming traffic is allowed based on the private IP addresses of the network interfaces that are associated with the source security group (and not the public IP or Elastic IP addresses).specify a security group as the source
Second approach is, As #samtoddler mentioned, you can allow the entire VPC network, or you can restrict it to a subnet.
I was misunderstood; gitlab-runner talks to gitlab, not the other way round, my understanding was gitlab talks to runners over SSH.
My immediate solution was 2 things:
Move the EC2 instance into a private subnet
As per #Aruk Ks answer, only allow EC2 to communicate over SSH to ECS Fargate tasks
This answered my question as well https://forum.gitlab.com/t/gitlab-runner-on-private-ip/19673
I am trying to deploy Spring Boot Application with AWS Elastic Beanstalk. Instead of using default settings for the environment, I modified something under "VPC". After picking availability zone and one of the security groups for the VPC, I created the environment.
However when I looked at the instance detail after it is created, I noticed it is tied to two security groups. Other than the one I chose sg-98c031f3, it has another newly-generated security group sg-72b94919.
Why does it create two security groups for the environment when I selected only one group? Is there a way to remove one of them since one security group is enough to handle all the rules.
Elastic Beanstalk will always create and utilize one security group that gets attached to the EC2 instance. This group is managed by Elastic Beanstalk and it's primary purpose is to allow inbound connections from your load balancer.
(It also has a secondary purpose of allowing inbound SSH connections if you have selected a keypair for your EC2 instances)
Elastic Beanstalk allows you to select 0 or more additional security groups to attach to your EC2 instances. Note that you do not need to select any security groups if you don't want to. This is so that you can add additional inbound/outbound rules for your EC2 instances without needing to modify the EB-managed one.
Some reasons why you might want to add additional security groups:
To allow more inbound ports (for example, RDP)
To allow outbound network connections (for example, NTP)
To act as sources and targets for other security group rules (for example, allow connections from your selected security group into your RDS instances)
I am setting up EMR clusters on demand, and have a windows EC2 server as a workstation, and a linux EC2 server as a secondary server. All in the same VPC. I would like to avoid having to set security group rules each time an instances comes up with a new IP.
How would I simply allow any traffic to flow freely between all servers in the same VPC?
Thanks!
EDIT- Thanks for the replies, I know this is not good practice in production, but we are dealing with some issues tracking down functionality which we believe is caused by ports, this is just a exploration phase, and this will help us. Thanks!
In the security groups, assign incoming access to other security groups by specifying a security group ID instead of IP addresses. In the web console, if you start typing "sg" in the source field it will pop up a list of your security groups to choose from. Using a security group ID as the source allows all resources that belong to that security group to have access.
Alternatively, if you just want one rule that allows access to every resource in your VPC you would specify your VPC's IP range.
to Allow any traffic between ALL servers in the VPC is not a good practice.
you should rethink in your VPC purpose.
Any way, if you want a group of servers to communicate with each other you can create a Security Group
And Assign it for all servers that you want.
and in inbound rules you add one rule from type "All TCP" and the source of this rule will be the same Security Group.
if your Security Group ID is 'sg-xxxxxxxx'
then the rule will be like this:
All TPC | TCP | 0-65535 | custom | sg-xxxxxxxx
To add to the other answers here, if you really want this, you can set it up via the Subnet or VPC IP CIDR Block
For example, if your VPC is 10.0.0.0/16, then add that to your security groups and all VPC traffic should be able to flow to each other.