4

At the moment, because it isn't possible to specify a security group from another region when allowing port access using amazon ec2's security groups, we have had to insert each individual IP into the security group that it needs access to. I can see this process becoming difficult to keep track of (it kind of already has).

My idea was to do something similar to what you can do between to Amazon VPCs (we can't switch to VPCs right now becauase the migration would be a little much at the moment), so have one server in each region acting as a gateway, where all requests from cross region servers come in. This gateway would then redirect the request to the proper endpoint. This way the security groups would only need one IP for cross region servers, rather than 1 per server.

Is this a valid technique? Are there other methods that might be better?

3

We just recently tackled this same issue in our (mainly) VPC environment. We have VPC instances running in us-east-1, us-west-1, and us-west-2. Here's the documentation from Amazon:

http://aws.amazon.com/articles/0639686206802544

With the VPN solution above, the source address stays that of the VPC (private IP) or in your case EC2 (public IP). There is no NAT. Therefore, you would get no benefit from the VPN at all.

I think given that you do not have VPCs, you should not attempt this approach at this time. Rather, institute a switch to VPC for all new instances and then setup the VPNs and use them going forward.

1
  • this seems like an ordeal, but you are definitely right.
    – tonyl7126
    May 17 '13 at 3:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.