Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I end up repeating external IPs in my security profiles
I understand how security groups can be used to specify Server to Server access. But is the following EC2 Security Group Configuration possible...

Group: Known Clients
TCP IPs:1.1.1.1/32 ports:any
TCP IPs:2.2.2.2/32 ports:any

Group: RDP Access
TCP port:3389 group:Known Clients

I have been unable to get something like this to work..

share|improve this question
    
Are the IP addresses for servers inside EC2 or outside? –  Eric Hammond Oct 15 '11 at 16:14
    
In this example, These IP Addresses were outside EC2. I wanted to get a better handle on access to these servers from the outside. –  AngrySpade Oct 17 '11 at 14:05
    
Then you have to repeat IP addresses, or just pile all the port permissions into one security group. –  Eric Hammond Oct 17 '11 at 18:06
add comment

1 Answer

up vote 0 down vote accepted

No, you cannot refer from one security group to the IP addresses in another security group. You would need to repeat the IP address list in each security group.

Another option to consider is to simply pile all of the port permissions for those IP addresses into a single security group. I.e., one list of IP addresses and one list of ports. Then add this security group to every instance that needs to give access to those IP addresses.

This approach might make sense if you control the severs in the IP address list as you are in charge of which instances they try to contact on which ports.

Remember that giving permission to connect on a specific server port (e.g., MySQL) does not do much harm if that particular instance is not running that particular service.

There is some risk that a service may be started where you didn't expect it to be, and some risk that your external servers under your control could be compromised by an attacker, and some risk that the attacker could find a way from your external servers into your EC2 servers using a port where you didn't expect to have a service running.

It's your decision to weigh the different benefits and risks and figure out what approach is best for each situation.

I tend to believe that a simple, easily maintained security structure is often the best approach as it reduces risks associated with making mistakes updating a more complicated security plan.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.