AWS: Make EC2 instances reachable from each other

Question

I have a VPC with several instances;

These need to be reachable among them via public urls, i.e. one instance, say

mysub1.mydomain.com

should be able to access

mysub2.mydomain.com

and vice-versa;

My only way for the moment to go about this is:

a) allocate ElasticIP to each one (so that they do not change)

b) add explicit allow rules in the respective security group so that the above requests are possible;

Since I am short on ElasticIPs, is there another way to go about this case, given that the instance number is expected to grow?

I can place those instances behind ELB or ALB if that solves the problem somehow;

edit: Could the usage of a NAT Gateway with a twist (that actually allows both incoming and outgoing traffic to/from my instances) be the solution to save IP addresses? but how can this be combined with a load balancer (either ELB or ALB) that I have to use during some requirements?

yes but with public IPs either way; no? since the requests will be publicly routed given I am using domain names; — pkaramol, Jul 23 '18 at 11:35
So, is your requirement more about making the instances available via the domain names or is it that the instances are reachable from each other (as the title suggests) — Arafat Nalkhande, Jul 23 '18 at 11:38
make the instances available from each other __via their domain names__ — pkaramol, Jul 23 '18 at 11:39
Then why not assign domain name to each of them , as they are in public subnet they shall be able to connect to each other and there is no need of EIP in this case. — Kush Vyas, Jul 23 '18 at 11:52
The request ending up to each such instance will originate from a public IP (either elastic or not); if this public IP is not allowed in my security groups, it will be blocked; — pkaramol, Jul 23 '18 at 12:01

score 1 · Answer 1 · answered Jul 23 '18 at 23:36

If your requirement merely that they communicate locally within the VPC to reach each other via their DNS names, you should be able to create a Private Hosted Zone for Amazon VPC in Amazon Route 53.

Add entries for each instance pointing to their private IP address. This way, the DNS name will resolve within the VPC to point to the private IP address rather than a public address. Traffic will flow within the VPC, without going out to the Internet. This also would not require an public IP addresses to be allocated.

If you also need the DNS names to resolve on the Internet (outside the VPC), you do not necessarily need to use Elastic IP addresses. Each Amazon EC2 can request a public IP address when the instance is created. You can point the public DNS names to this address. However, please note that the public IP address might change if the instance is stopped and started (whereas Elastic IP addresses will not change).

score 0 · Answer 2 · answered Jul 23 '18 at 12:02

Ideally, you should create a VPC with public and private subnets (https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Subnets.html) and place your instances (unless specific needs) in private subnets.

You will then configure external and internal load balancers and DNS for communication so that you don't need to rely on public IPs and you can scale your application (you can use either classic or application load balancers depending on your needs).

You can set up public and private DNS zones on route53 (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html) so that you can resolve certain endpoints just from inside the VPC.

You can then even improve security by creating "security-group to security-group" rules or restricting inbound traffic to specific subnets.

So more or less I need 2 load balances (1 internal + 1 internet facing) and 2 hosted zones (1 public + 1 private) so that I route/allow the internal (without the need for public IP addesses) as also the external traffic? — pkaramol, Jul 23 '18 at 12:47
Yes, in that's in general how most of the infrastructures I've worked with look like. The first rule is to never expose something to the internet unless is strictly needed. — Gabriel, Jul 27 '18 at 14:43

AWS: Make EC2 instances reachable from each other

2 Answers2