I manually created a new security group using the AWS CLI.
I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and MySQL (3306).
I also deleted the default egress rule that allows all outbound connections, and instead created an egress rule that only allows outgoing connections to my company's public IP address (but all ports there).
Those rules initially worked fine, but now I want my EC2 virtual machines to be able to read from and write to S3. Unfortunately, S3 commands are currently failing. (Console output: "ERROR: [Errno 110] Connection timed out") I am sure that the cause is my initial overly restrictive egress rule.
So, what egress rule should I use to allow my AWS EC2 instances to read from and write to S3?
A web search found this old discussion on the AWS forums. If I understand it correctly, it looks like AWS refuses to publish the S3 IP addresses because they want the flexibility to change stuff. If this is true, does that make it impossible to specify an egress rule for S3?
This AWS document states: "A common practice is to use the default setting, which allows any outbound traffic." Do people use the default anything goes for outbound traffic, in part, to enable connections with S3?
Note: I am only using EC2-Classic, never EC2-VPC.