2

I currently have 20 Windows VMs that are running on Amazon EC2. There are LOTS of people in the company that need ad-hoc RDP access to each one of these boxes. Occassionally I also run Unix instances, which again tend to have a lot of ad-hoc SSH access from a large number of users.

So now I have a problem... When these boxes run within my datacenter I can fully control them. I can specifically implement these controls:

  1. Disable any outbound Windows or Unix traffic from a specific subnet to the public internet, so as to stop company data somehow flowing out of our premises.

  2. Disable any inbound access from people's homes, as we do not permit inbound SSH or RDP onto our premises.

I thought of just 'privatizing' my EC2, by enabling VPC (VPN) connectivity. But I don't like this solution for many reasons, which include both cost and routing challenges to do with our specific network design.

Is there any other way to meet my goals? I definitey don't want to configure each machine to 'block' specific traffic behaviors or activities. That's a pain. One thought I had was to configure the Security Groups to somehow make traffic flow only in the 'right direction', but I'm unclear as to how this would be done...?

4 Answers 4

3

OK, this is an old question that I'm first seeing now.

The options for "secured networks" or VPNs spanning multiple servers on EC2 are pretty much only:

  1. Amazon's own "Virtual Private Cloud", a.k.a. VPN-as-a-service from Amazons datacenter to your own firewall, as you mentioned.
  2. 3rd party VPN 'overlay' networks like VPN-Cubed, which partners with Amazon and is available as a pay-as-you-go EC2 machine image. I haven't worked with this myself, but judged by Amazons webinar it has more features and a far better managment interface than VPC.

Aside from the above you could try adhoc VPNs between end users and individual servers based on fx OpenVPN. But installing & configuring the client on many end user PCs might get old fast.

2

Unfortunately for the Network features you are looking into VPC is the best option. Regular EC2 instances do not have Outbound filtering or ACLs.

Use VPC as a pseudo private cloud, but without the dedicated hardware tunnel. You can set up Internet Gateways and set up a few public machines that route traffic for the other servers that are in a private subnet. VPC does not have any additional costs associated with it. This will also give you outbound Security Group rules and Subnet wide ACLs.

The only other alternative I can think of is to keep implement the network rules on the VMs themselves.

0

Another commercial tool that will do the job is Apani Epiforce, but it will require some manual setup on each server instance, as well as setting up a dedicated policy server.

0

Security groups. It allows you to control both inbound and outbound connections. Create multiple security groups based on your needs and you can assign them to multiple EC2 instances. For example, DMZ security group for web servers, app security groups for app servers and so on.

You must log in to answer this question.