1

In AWS, I have an EC2 instance which currently allows incoming traffic on port 80. I am hosting an API on this instance and so currently I can hit the API endpoints using Postman at the public IP of the EC2 instance. So far so good.

Next, I have set up an internet-facing, application load balancer with an SSL cert and a subdomain (call it api.whatever.com). The security group for the load balancer prevents port 80 traffic, but allows port 443 (HTTPS) traffic. And the load balancer is configured to forward requests to the EC2 instance via port 80.

So, I can hit my API and get a response through the load balancer, for example like https://api.whatever.com/something.php. While http://api.whatever.com/something.php is unreachable because port 80 is blocked. This is what I want.

However, now what I want to do is prevent the EC2 instance from responding to HTTP requests from anywhere other than the load balancer. But of course if I remove port 80 from the EC2 security group, the load balancer can no longer contact it because it uses port 80. I was looking for an IP address of the load balancer so I could whitelist that IP in the security group on port 80, but I was unable to find such a thing.

How can I exclude port 80 access to my EC2 instance to everything except the load balancer?

Improve this question

1 Answer 1

Reset to default
5

Remove global access to port 80 for the instance, and only permit traffic from the ELB's security group.

This can be done via the console:

enter image description here

or via the CLI:

aws ec2 authorize-security-group-ingress
  --group-name MyEC2Group
  --protocol tcp
  --port 80
  --source-group MyELBGroup
Improve this answer
2
  • You know what? I thought so. But, I can't seem to figure out how to do it from the console, and using the CLI is not... shall we say convenient. Any quick words of advice how to do it from the console?
    – robbpriestley
    Nov 28, 2018 at 17:37
  • @robbpriestley Just start typing the name or ID of the security group into the IP address field. It'll suggest matches. See my screenshot.
    – ceejayoz
    Nov 28, 2018 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .