up vote 1 down vote favorite
share [g+] share [fb]

What is the preferred way to configure Amazon Security Groups to achieve a multi-tier architecture?

Each of my instances has its own Security Group, which I only want to use for rules specific to an instance. I'd like to keep any rules which apply to multiple instances in a separate Security Group, which can then be assigned to instance Security Groups as necessary.

As an example, I've setup a group called "admin", which allows administrative access from my IP. I added the "admin" group as the source to each of my instance security groups. However, I still can't access the instances from my IP without adding the rules directly to the instance's group.

Am I missing something? Although it seems a multi-tier security architecture should be possible, it doesn't seem to be working.

link|improve this question
86% accept rate
feedback

2 Answers

up vote 1 down vote

I have it set up as:-

Group web
Perm 0.0.0.0/0  ports 80,443

Group tomcat
Perm web port 8009

Group application
Perm tomcat ports 42000-42300

Group db
Perm application 1521
Perm tomcat 1521

Group ssh
perm x.x.x.x/32 22

Everything is assigned ssh and then each server get's what is required to do it's job. So one server has ssh, application and db so 1521, 42000-42300 & 22 are all opened.

Seems to work pretty well.

link|improve this answer
feedback
up vote 0 down vote

You can try adding the admin group to the instance-specific security groups. The section in the rules for a source IP address allows you to use the name of your other security groups. This is how you can get systems in different security groups to communicate as well.

link|improve this answer
I saw that section, but it didn't seem to work when I tried it. – ks78 Mar 10 '11 at 20:23
Have you setup a set of multi-tier security groups? Can you give me an example of how you did it? – ks78 Mar 10 '11 at 21:06
@ks78 I've not setup an actual multi-tier setup myself. And reviewing what I do have setup it doesn't look like that works as I first thought. What it does do is allow machines in those different security groups to communicate across groups. That's handy because you can't change the group that a system belongs to without launching a new instance of it. This probably isn't what you want in your setup. – zilla Mar 10 '11 at 21:17
@ks78 So I'll go back to the drawing board myself as I'm still setting up a not entirely-dissimilar setup where a multi-tier setup would be nice. I think I'm going to be stuck with adding some duplicate rules across the different groups. – zilla Mar 10 '11 at 21:18
Currently, the best work-around I've found is to assign an instance to multiple security groups when its first launched. However, that will be a pain if I ever need to add or remove a security group from an instance. – ks78 Mar 10 '11 at 21:52
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.