I have two EC2 instances in same regions. Lets call them instance-1
and instance-2
. instance-1
has an Elastic IP address attached to it but instance-2
does not.
I want my instance-1
to allow inbound traffic from instance-2
in its iptables
. I could assign an Elastic IP to instance-2
and add something like below to the INPUT
chain.
ACCEPT tcp -- xx.xx.xx.xx anywhere tcp dpt:yyyy
ACCEPT tcp -- xx.xx.xx.xx anywhere tcp dpt:zzzz
Where xx.xx.xx.xx
is Elastic IP of instance-2
and yyyy
and zzzz
are destination ports.
But since Amazon restricts the number -- five -- of Elastic IP addresses assigned to an account I don't want this instance to have an Elastic IP address.
My question is can I use internal IP address, in the form of 10.xx.xx.xx, provided by Amazon to instance-2
in iptables
of instance-1
?
A solution could be to stop using instance level iptables and use Security Groups provided by EC2. But I'm a little bit apprehensive about this. I feel it's better to protect the system from unknown inbound traffic at instance level as well as at security group(EC2 application) level.