Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the preferred way to configure Amazon Security Groups to achieve a multi-tier architecture?

Each of my instances has its own Security Group, which I only want to use for rules specific to an instance. I'd like to keep any rules which apply to multiple instances in a separate Security Group, which can then be assigned to instance Security Groups as necessary.

As an example, I've setup a group called "admin", which allows administrative access from my IP. I added the "admin" group as the source to each of my instance security groups. However, I still can't access the instances from my IP without adding the rules directly to the instance's group.

Am I missing something? Although it seems a multi-tier security architecture should be possible, it doesn't seem to be working.

share|improve this question

I have it set up as:-

Group web
Perm  ports 80,443

Group tomcat
Perm web port 8009

Group application
Perm tomcat ports 42000-42300

Group db
Perm application 1521
Perm tomcat 1521

Group ssh
perm x.x.x.x/32 22

Everything is assigned ssh and then each server get's what is required to do it's job. So one server has ssh, application and db so 1521, 42000-42300 & 22 are all opened.

Seems to work pretty well.

share|improve this answer

You can try adding the admin group to the instance-specific security groups. The section in the rules for a source IP address allows you to use the name of your other security groups. This is how you can get systems in different security groups to communicate as well.

share|improve this answer
I saw that section, but it didn't seem to work when I tried it. – ks78 Mar 10 '11 at 20:23
Have you setup a set of multi-tier security groups? Can you give me an example of how you did it? – ks78 Mar 10 '11 at 21:06
@ks78 I've not setup an actual multi-tier setup myself. And reviewing what I do have setup it doesn't look like that works as I first thought. What it does do is allow machines in those different security groups to communicate across groups. That's handy because you can't change the group that a system belongs to without launching a new instance of it. This probably isn't what you want in your setup. – zilla Mar 10 '11 at 21:17
@ks78 So I'll go back to the drawing board myself as I'm still setting up a not entirely-dissimilar setup where a multi-tier setup would be nice. I think I'm going to be stuck with adding some duplicate rules across the different groups. – zilla Mar 10 '11 at 21:18
Currently, the best work-around I've found is to assign an instance to multiple security groups when its first launched. However, that will be a pain if I ever need to add or remove a security group from an instance. – ks78 Mar 10 '11 at 21:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.