How to make security groups between load balancer and ec2

Question

I have recently added a ALB for 2 instances in EC2.

I want to make the ALB and EC2 instances to be private so I added the security group for each services.

What I did is that I added the IP Addresses in HTTPS of the EC2 instances in the ALB sg. vice versa in the EC2 sg.

In Route 53. I made a subdomain to link in the DNS name of ALB.

I tried to test it first using sg that is public and it works fine and can access the EC2 application. But after I tried to set the sg for both the ALB and EC2. When I test it, It can't access it.

Where did I go wrong?

score 1 · Accepted Answer · answered Aug 30 '18 at 03:08

1

A security group can allow traffic from a CIDR range of IP addresses, or from another Security Group. Thus, you should configure the following Security Groups:

ALB-SG: Allow HTTP/S from 0.0.0.0/0 (if you want it open to the world). Associate it with the ALB.
App-SG: Allow HTTP from ALB-SG. Associate it with your EC2 instances (or Auto Scaling group Launch Configuration).

The Application Security Group (App-SG) is thus permitting incoming traffic from the Load Balancer. Or, more specifically, from any resource that is associated with ALB-SG.

Route 53 should have a CNAME record pointing your desired domain name to the DNS Name of the Load Balancer.

answered Aug 30 '18 at 03:08

John Rotenstein

241,921
22
380
470

For allowing the ALB in App-SG. We will use it's IP ADDRESS? It seems that it is not static? If so, how to get the static IP Address for ALB. Thanks – Richard Vergis Aug 30 '18 at 05:31
Can we use VPC CIDR for the ALB in App-SG? – Richard Vergis Aug 30 '18 at 05:43
Yes. That would restrict access to the Load Balancer to only resources _within_ the VPC. – John Rotenstein Aug 30 '18 at 05:52
Thank you. It works now when I access the domain. The problem is when I access the api routes of the APP it gets 404 Not Found nginx – Richard Vergis Aug 30 '18 at 05:59
The ALB is in HTTPS. Do we need to get a SSL Certificate for nginx in APP? – Richard Vergis Aug 30 '18 at 06:08
No. The ALB can terminate the SSL session, sending HTTP to the application servers. – John Rotenstein Aug 30 '18 at 06:17

How to make security groups between load balancer and ec2

1 Answers1