Amazon EC2: IP Lists with Security Groups

Question

I end up repeating external IPs in my security profiles
I understand how security groups can be used to specify Server to Server access. But is the following EC2 Security Group Configuration possible...

Group: Known Clients
TCP IPs:1.1.1.1/32 ports:any
TCP IPs:2.2.2.2/32 ports:any

Group: RDP Access
TCP port:3389 group:Known Clients

I have been unable to get something like this to work..

Answer 1

No, you cannot refer from one security group to the IP addresses in another security group. You would need to repeat the IP address list in each security group.

Another option to consider is to simply pile all of the port permissions for those IP addresses into a single security group. I.e., one list of IP addresses and one list of ports. Then add this security group to every instance that needs to give access to those IP addresses.

This approach might make sense if you control the severs in the IP address list as you are in charge of which instances they try to contact on which ports.

Remember that giving permission to connect on a specific server port (e.g., MySQL) does not do much harm if that particular instance is not running that particular service.

There is some risk that a service may be started where you didn't expect it to be, and some risk that your external servers under your control could be compromised by an attacker, and some risk that the attacker could find a way from your external servers into your EC2 servers using a port where you didn't expect to have a service running.

It's your decision to weigh the different benefits and risks and figure out what approach is best for each situation.

I tend to believe that a simple, easily maintained security structure is often the best approach as it reduces risks associated with making mistakes updating a more complicated security plan.