We'd like to be able to access the instances in our VPC from the various public IPs that we have in our corporate network. Is it possible to create security groups (like operator-security-group) and put rules on it that are inherited when applied to instances of an existing security group?

I tried the following configuration and it didn't work: sg-operator (security group created not associate an any instance) port 3389 source my ip:

sg-server1 (security group associate an instance) port 3389 source "sg-operator"

It seems to me that rules added in security groups only work when they are directly associated with the instance, is there another way?


Security group rules aren't able to be inherited by other groups. What you need to do is to create your sg-operators security group and then apply it to a group of instances directly, which you can easily do in a VPC (not in Classic).

Background: Adding an allow rule for a security group to an existing security group means that the instances in the source security group are able to communicate with the instances in the existing security group over the specified ports and protocols. It doesn't mean that any traffic that's allowed in by an attached security group is allowed in to an associated security group, which is really a better solution.

This lets you do things like define a database server security group for your DB servers and then create a rule to allow traffic on port 3306 from instances in the web server security group.

  • difficult concept. e.g. not all the traffic, just the instances. Would ssh into that instance qualify? Or is it just the apps on that instance, or what exactly is the dividing line? – Brian Thomas Jun 26 at 23:10

Security groups regulate access to instances, so they do need to be associated with instances to do anything. You can associate more than one security group with an instance, which will combine its rules where that server's access is concerned.

Our web servers, for example, have a security group granting port 80 access to, as well as a security group granting port 22 access to our office IP.

  • yes right but if you want add inside a security group another security group that is not associate with anything doesn take the rule. look the example above. – maumau Aug 26 '14 at 11:46
  • @maumau What you're looking to do isn't possible. – ceejayoz Aug 26 '14 at 11:50
  • would much easier if wolud possible in this way you can create your rules and add that security group inside the sg of the istances. :-( – maumau Aug 26 '14 at 11:54
  • @maumau You can do that. As I noted, "You can associate more than one security group with an instance". – ceejayoz Aug 26 '14 at 12:04

find the solution ..or workaround.

go to istance and: change security group

you can associate more than one security group an instance.

Works only for vpc of course :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.