I manually created a new security group using the AWS CLI.

I created ingress rules that allow incoming connections only from my company's public IP address using the known ports for SSH (22) and MySQL (3306).

I also deleted the default egress rule that allows all outbound connections, and instead created an egress rule that only allows outgoing connections to my company's public IP address (but all ports there).

Those rules initially worked fine, but now I want my EC2 virtual machines to be able to read from and write to S3. Unfortunately, S3 commands are currently failing. (Console output: "ERROR: [Errno 110] Connection timed out") I am sure that the cause is my initial overly restrictive egress rule.

So, what egress rule should I use to allow my AWS EC2 instances to read from and write to S3?

A web search found this old discussion on the AWS forums. If I understand it correctly, it looks like AWS refuses to publish the S3 IP addresses because they want the flexibility to change stuff. If this is true, does that make it impossible to specify an egress rule for S3?

This AWS document states: "A common practice is to use the default setting, which allows any outbound traffic." Do people use the default anything goes for outbound traffic, in part, to enable connections with S3?

Note: I am only using EC2-Classic, never EC2-VPC.

  • 1
    Have you looked at aws.amazon.com/blogs/aws/new-vpc-endpoint-for-amazon-s3 ? – ceejayoz Jun 17 '15 at 21:24
  • I came here to point you to the exact doc @ceejayoz already pointed you to. :) – EEAA Jun 17 '15 at 21:29
  • ceejayoz: I should have been more specific: I am only using EC2-Classic, never EC2-VPC. (I have edited my original question.) So, I do not think that your link will work for me, right? – HaroldFinch Jun 17 '15 at 22:12
  • 5
    You should consider moving to VPC, it's not that complicated and VPC has so many additional features now over classic. – thexacre Jun 17 '15 at 23:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.