Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to be able to have instances from one of my ec2 clusters to talk to instances in another ec2 cluster in real time (not via a rdbms or messaging queue).

I'm thinking the best way to do this is with SSH (communications so far are only one way), as this communication doesn't occur very often, and it doesnt make sense to have something always open listening for requests (like a webserver, or some other specialized socket app).

1) Is there a better way of doing this than using SSH?

2) Is there a way of using amazon or plain old SSH to easily restrict SSH logins based on security group? I don't want to have to worry about creating a dynamically changing IP white list, or managing a bunch of random passwords, or storing different pem files in my DVCS. What I'd ideally like is one password or pem that is used for interinstance communication across all environments, and then set firewall rules that prevent SSH access for any machine that is not in the designated security group.

share|improve this question
1. Use a virtual private cloud. 2. Sure, that's the whole point of security groups. – ceejayoz Jun 21 '13 at 20:46
To clarify 2, I'd like to have port 22 open for other security groups and IPs other than the cluster in question. Basically I want to restrict the use of a pem or password using security group, but not the actual traffic to a port. Is this possible, and if so how? – blefko Jun 21 '13 at 20:49
You said you don't want to use a messaging queue, but why not use Amazon's SQS? If you're worried about securing the data, you can encrypt the payload. It's real-time (well, within a couple hundred milliseconds) and with a long-poll time of 20 seconds, waiting for infrequent messages is not CPU intensive. – Johnny Jun 21 '13 at 20:50
Right, I guess what I meant is that I'd prefer "push" instead of a pull/poll approach. With SSH I wouldn't have to write and run another process running and polling an SQS queue, I'd just have sshd running. – blefko Jun 21 '13 at 21:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.