Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

What happens when I assign multiple security groups to an instance? Is it permissive in the sense that the traffic is allowed in if any one of the security groups allows it. OR is it restrictive in the sense that every security group must allow the traffic in for it to be passed in?

For example, lets say I have a class of instances that will only ever talk to other instances in the same account. I also have a class of instances that will only accept traffic via http (port 80).

Is it possible to restrict access to internal instances and only via http by creating and applying two security groups: 1. An "internal" security group. Allow all traffic in from other members of that security group on all ports for all transports (TCP, UDP, ICMP) 2. Create an "http" security group. Allow all traffic into port 80 via TCP from any source.

OR am I forced to create a single security group that allows traffic from port 80 where the source is itself?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

If an instance has multiple security groups, it has the sum of all rules in the various groups.

For example, lets say I have a class of instances that will only ever talk to other instances in the same account. I also have a class of instances that will only accept traffic via http (port 80).

This is a perfect situation for AWS Virtual Private Cloud. Put the internal instances in private subnets, and the public-facing instances in public subnets.

share|improve this answer
    
ceejayoz - So it's the "restrictive" case? Meaning the two security group solution would work? Agreed about VPC solution; my example was more to understand how multiple groups work. Where did you find the answer by the way? –  SFun28 Mar 1 '13 at 22:08
    
You'd want one security group for internal instances, and another for the public-facing instances. Adding the public-facing 80:0.0.0.0/0 group to internal instances would make them available to the public internet. –  ceejayoz Mar 1 '13 at 22:15
    
Just to be super clear, you are saying that traffic is let in if any of the individual security groups allows it? I'm being thrown off by your comment about the "sum of all rules" because when I think of sum I think AND instead of OR. –  SFun28 Mar 1 '13 at 22:58
    
Yes, if any of the groups applied to an instance allows it, it's allowed. Group rules are ORed together, not ANDed. –  ceejayoz Mar 2 '13 at 20:57
    
why can't people just answer the question asked instead of inserting their idea of what should be done. If you're going to do that at least properly answer the question first. Jeez –  BillR Jun 26 '13 at 17:35

Here's the response from AWS documentation support. They said they would update the documentation:

I found a couple of discussion forum posts that address similar issues with conflicting rules within one or more security groups:

https://forums.aws.amazon.com/thread.jspa?messageID=221768

https://forums.aws.amazon.com/thread.jspa?messageID=349244&#349244

When multiple security groups are applied to an instance, the rules are aggregated to create one large set of rules. In EC2, security group rules are only permissive, in other words, you cannot add any DENY rules. What this means is that the most permissive rule will always apply. For example, if you have a security group that allows access to port 22 from IP address 10.10.10.10, and another security group that allows access to port 22 from everyone, everyone will have access to port 22 on the instance.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.