0

I'm setting up my first instance on EC2, and trying to find clear information on the security group settings is a bit difficult for a newbie like me. Are there some suggested settings that give a standard level of security for a production website built with PHP and MySQL? In particular, what sort of things should I be looking out for?

3
  • 1
    its deny by default, so allowing just tcp port 80 (And someway for you to ssh in) should be ample.
    – Sirex
    Oct 18, 2013 at 3:08
  • So these two entries are the only ones I need?
    – Chris
    Oct 18, 2013 at 3:46
  • You will need 443/TCP from 0.0.0.0 also if you have HTTPS on your site.
    – talonx
    Oct 18, 2013 at 19:00

2 Answers 2

1

the aws cli tools is what you are looking for.

===> http://aws.amazon.com/developertools/351

you can use them to create a security group (ec2-create-group), assign it to an instance (ec2-run-instance), and add acls (ec2-authorize).....

for instance, to allow tcp/80 from the public internet, you would execute:

==> ec2-authorize [security-group-id] -P tcp -p 80 -s 0.0.0.0/0

all the cli tools can be run with -h for information on usage.

2
  • I understand how to create and assign security groups, but I just want information on the correct settings to use for a 'standard' website with normal access for users
    – Chris
    Oct 18, 2013 at 3:47
  • "ec2-authorize [security-group-id] -P tcp -p 80 -s 0.0.0.0/0 "thats the bare minimum you need to have a webserver HTTP up. i listed the two prerequistes. 3 steps.
    – nandoP
    Oct 26, 2013 at 23:19
0

There's a lot of basic information about AWS security groups on the web you can try these:

http://support.rightscale.com/12-Guides/Dashboard_Users_Guide/Clouds/AWS_Regions/EC2_Security_Groups/Concepts/About_EC2_Security_Groups

or

http://cloud-computing.learningtree.com/2010/09/24/understanding-amazon-ec2-security-groups-and-firewalls/

Its important to understand first the fundamentals of a thing/tools before applying it.

With regards to security, you can also implement other approach like using IPtables if your using Redhat base or UFW if your using Ubuntu Linux or installing reverse proxy and other security plugins etc. that will help to harden different level of your security to your website

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .