I have a load balancer with public IP, which delegates calls to two EC2 web servers on a private subnet in AWS VPC. For redundancy reasons, each on a separate private subnet. Let them be denoted as A1, A2.
These web servers are required to pass calls to another EC2 instance. Let it be denoted as B.
I want it to have incoming connections only from A1, A2.
However, For internal reasons, I do not want to duplicate this EC2 instance for every private subnet. Therefore, my suggested solution is to restrict B's security group to have inbound rule to accept connections only from A1, A2.

How can I restrict inbound traffic of an EC2 instance outside of my private subnets, so it will accept traffic only from instances from within the private subnets?

I believe I should look for the public IP of the internet gateways of these private subnets, however it seems that such is associated only with a public subnet.


Instances can have multiple security groups. Security groups can reference other security groups as source. Security groups are linked to the VPC level.

In this case a solution can be:

  • A1, A2 in the same security group A.
  • B having a different security group holding an inbound rule that allows connections from security group A.
  • My question is more about how to I find the public IP to restrict traffic from, so it will enable traffic only from the private subnet instances (which naturally do not have a public IP).
    – oleiba
    Dec 30 '18 at 9:05
  • @oleiba And hargut explained that's unnecessary since you can allow from a security group rather than an IP, which solves your stated problem.
    – jordanm
    Dec 30 '18 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.