2

I have several Ubuntu machines inside VPCs. For many of them, the only network access they need whatsoever is for "apt-get update && apt-get upgrade" and NTP. For NTP, I can simply have an NTP server with internet access inside of the VPC. But, for apt, will I have to create an apt mirror? VPC Endpoints seem to provide access to S3 from inside the VPC, and, apparently, there are S3 apt mirrors for Ubuntu. What is the correct way to use these S3 mirrors, or how do others manage apt updates inside of AWS VPC instances? It seems that creating a NAT instance would be overkill. I have added a VPC Endpoint but still cannot access us-east-1.ec2.archive.ubuntu.com for example. Using us-east-1.ec2.archive.ubuntu.com.s3.amazonaws.com, I get an HTTP connection but apt just shows failures of either 404 Page Not Found or 403 Forbidden.

6
  • 1
    Why not just associate an EIP with your machines? Or select the "public IP" option when creating them?
    – EEAA
    Jun 22, 2015 at 4:14
  • It's a security vulnerability. The only thing I want them having access to are the apt updates.
    – Will
    Jun 22, 2015 at 23:15
  • @Will - why do you think that what EEAA is suggesting is a security vulnerability? just create a security group that only allows outbound and blocks all in, it's very simple and easy to set up and secure.
    – hookenz
    Jun 22, 2015 at 23:32
  • 1
    Allowing outbound does reduce security. "Egress filtering helps ensure that unauthorized or malicious traffic never leaves the internal network." (from wikipedia). Jun 23, 2015 at 0:41
  • 1
    We have to do the same thing for PCI compliance stuff. Interesting thing I found is that us-east-1.ec2.archive.ubuntu.com is not an S3 bucket. I think it might be a group of EC2 instances. us-east-1.ec2.archive.ubuntu.com.s3.amazonaws.com should work just fine.
    – nwalke
    Jul 31, 2015 at 19:16

2 Answers 2

1

The 403s are expected as directory indexing is not allowed in S3.

For the 404s you may be doing something wrong. For example, http://us-east-1.ec2.archive.ubuntu.com.s3.amazonaws.com/ubuntu/dists/lucid/Release works for me.

0

Unfortunately this is no longer possible because Ubuntu no longer hosts their mirrors on S3, so VPC Endpoints are not an option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .