Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have one EC2 instance that is starting to send alerts for high CPU usage. I want to create another instance and use this instance for the database and keep my existing instance for the web server.

I'm running Windows Server 2008 R2 and have an Elastic IP for the current server.

I want to install another instance, install SQL Server express and allow the instances to communicate using SQL Server, however I don't want SQL Server to be open to the rest of the internet, just the web server instance.

Can anyone give advice on how to easily do this?

share|improve this question
1  
Why don't you just use an RDS instance for your database instead? –  jamieb Dec 20 '12 at 0:22
    
+1 to @jamieb's suggestion to investigate RDS, but otherwise, you're going to want to look at the EC2 concept of "security groups". docs.amazonwebservices.com/AWSEC2/latest/UserGuide/… –  Eric Hammond Dec 20 '12 at 1:12
    
Thanks, I'll have a look at RDS as well. –  Paul Dec 20 '12 at 1:39
    
Have you looked at amazon EC2 Dashboard (Security Group) allow the communication for SQL port for specific instance IP only. –  PratapSingh Dec 20 '12 at 8:57

1 Answer 1

up vote 1 down vote accepted

Whether you use RDS or SQL Server on your own EC2 instance, the following can be done to restrict connections to your SQL Server to only those originating from your EC2 instance.

  1. When you start your RDS Server or EC2 Instance with SQL Server, you will be given a choice of the Security Group to assign to the server/instance. Let's call that SecurityGroup1.

  2. Your original EC2 instance is also has a security group assigned to it. Let's call that SecurityGroup2.

  3. In the configuration for SecurityGroup1 (whether RDS or EC2), you can allow connections on port 1433 (the default SQL Server port) to SecurityGroup2. You may need to specify the group by is sg- identifier. If you close traffic to all other sources (ie. don't allow anything else), then you've effectively restricted connections.

Note that the above will only work when the 2 servers are in the same region.

share|improve this answer
    
Thanks Matt, just what I was after. –  Paul Dec 20 '12 at 22:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.