2

Please help

We blocked all the outgoing traffic by removing 0.0.0.0/0 and added only our VPC so as our application connects to the EC2

Now the problem is EC2 is not able to communicate with any of AWS Services itself; we are not able to use SSM, update our RPM, etc. ..

we added few of the IP range based on the errors we faced; which we fear not the correct way of blocking the outbound connections

Thank you, appreciate your support in advance

Varadharajan Nadar
  • 357
  • 1
  • 2
  • 11
  • Why did you choose to block outgoing traffic in security groups? Traditionally, Outbound rules are left open to allow software on the instance to access the Internet (eg for downloading updates, or talking to AWS). There can be some good reasons for blocking such access, but I'm just checking why you made that choice? – John Rotenstein Aug 10 '20 at 00:54
  • Agree with you; we do not want each and every server to have direct access to whole world rather than only the known source and correct protocol; even to download the updates we can make sure the respective repo & protocol are whitelisted – Varadharajan Nadar Aug 10 '20 at 16:06

1 Answers1

1

You should actually take a look at using VPC endpoints where possible within your VPC.

If you configure these outbound communication will be via the subnet ranges that the interface endpoints are located in with the exception of S3 and DynamoDB.

If you use either of these services, in the outbound of the security group you can whitelist the source of the prefix list for these services.

By doing this its easier to manage (AWS IP ranges change all the time), and is more secure as the egress stays within the AWS network never connecting to the service endpoints via the public internet.

If this approach is not for you, you would need to subscribe to ip-range changes which would trigger a Lambda function. This Lambda function would access the ip-ranges.json file and retrieve all ranges valid for your application. These IP ranges would then be added to a customer managed prefix list that you define.

The prefix list would be added as an outbound destination allowing port 443 (HTTPS) outbound access, of course this method would require you to build the Lambda function.

Chris Williams
  • 32,215
  • 4
  • 30
  • 68