0

I have created an EC2 Security Group that allows incoming traffic from a private ip address in the same account.
It is my understanding that a private ip address for a classic instance can change after reboot. So this rule could be invalid after a reboot.
( https://stackoverflow.com/questions/10733244/solution-for-local-ip-changes-of-aws-ec2-instances )

I really just want to use a dns name as the source, but that does not seem to be possible. I can't reference the other instance by it's security group because it's not the right group and amazon doesn't allow changing security groups...

What are my options to allow local trafic to one instance from a specific ip address in the same account in a robust way ?

4
  • If you have reached the 5 IPs per region you can still request more in a form, seems that getting an Elastic IP for this instance could be a (non-scalable) fix, not a generic solution though. Apr 9, 2014 at 13:23
  • I can't just get a private static ip ? That would really solve everything. Apr 9, 2014 at 13:41
  • that would be basically using Amazon's Virtual Private Cloud Apr 9, 2014 at 13:44
  • Sounds more to me like EC2 classic instances are a broken product Apr 9, 2014 at 13:47

2 Answers 2

1

Firstly, private ip addresses don't change after reboots; they change after an instance is stopped and then started again. Different things.

You can create an AMI from any EBS backed instance. Look for "Create Image" under the actions menu. If you can do this, redploy the AMI in a dedicated Security Group, and then use that Security Group ID as the source in your secondary Security Group. Then, you will have no problems with changing ip addresses.

If you can't see the "Create Image" option, you have an Instance Store backed instance. These are ephemeral (ie temporary) so you have limited options when it comes to moving them around or copying them.

If you are planning on using a server long term, you really need to set it up as an EBS backed instance, and deploy it in a VPC, rather than in Classic EC2.

0

You may add both instances to one security group and specify this group as a source, or specify this particular instanсes's security group. As stated in AWS documentation:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html

One or the following options for the source (inbound rules) or destination (outbound rules):
[skip]
EC2-Classic: A security group for another AWS account in the same region 
(add the AWS account ID as a prefix; for example, 111122223333/sg-edcd9784)
When you specify a security group as the source or destination for a rule, the rule affects all
instances associated with the security group.
For example, incoming traffic is allowed based on the private IP addresses 
of the instances that are associated with the source security group.

ps. there is still a way to change security group altough with some downtime: stop instance, make AMI, start newinstance in new SG

2
  • I can't shut down the instance and I also can't copy it there is no 'AMI', this is a server with lots of custom stuff on it. it I've also found out that referencing source by security group doesn't even work unless the source is an elastic IP, Which makes no sense at all but seems to be the case. So unfortunately this will not work for me at all.. Apr 9, 2014 at 13:12
  • I am not familiar with the classic EC2 instances, but with the new instances you can create an AMI from any snapshot.
    – mtak
    Apr 9, 2014 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .