2

I have a ec2 instance that is running a website and associates ALB.

normally as a practice inside the ec2 instance security group, alb security group is referenced, but here the client has a configuration in such a way that inside ec2 instance the source is name of the security group itself.

security group for ec2 instance whose name is

sg-0bc7e4b8b0fc62ec7 - default

As per my understanding of aws security group, under an inbound rule when it comes to source, we can mention IP address, or CIDR block or reference another security group.

But what does this mean for an inbound rule where ALL traffic, all ports are allowed but for source = sg-0bc7e4b8b0fc62ec7 / default.

I am confused with usage of the same name of the security group as source, what this rule will mean?

Jatin Mehrotra
  • 9,286
  • 4
  • 28
  • 67

1 Answers1

6

Each VPC has a default security group (SG). In this SG, inbound rule allows all incoming traffic from "itself". This means that

When you specify a security group as the source for a rule, traffic is allowed from the network interfaces that are associated with the source security group for the specified protocol and port.

In other words, if you have two instances that use the default VPC SG, they can only communicate with each other. No other inbound traffic is allow to either instance.

The use of SG as source is a good practice and if often used between load balancer (LB) and its instances, or between instances and RDS database. In the first case the instances allow incoming traffic only from the SG of the LB, while in the second case, db instance allows incoming connections only from SG of the instance.

Marcin
  • 215,873
  • 14
  • 235
  • 294
  • `The use of SG as source is a good practice and if often used between load balancer (LB) and its instances`, i have a similar situation however the client has source as name of security group but not load balancer security group and yet website is accesbile from load balancer dns address only. – Jatin Mehrotra Apr 02 '21 at 11:14
  • @JatinMehrotra Its a good practice not a requirement. In your client's case the instances could be in private subnets. Thus they won't be accessible through internet. – Marcin Apr 02 '21 at 11:16
  • I have updated my question can you please take a look – Jatin Mehrotra Apr 02 '21 at 11:17
  • yes instances are in private subnet but `how is it possible that ALB is able to route traffic from itself to ec2 instance` but the source is mentioned as instance security group and not ALB security group? As per my understanding if alb is not mentioned in instance security group ec2 should not allow any traffic to instance from ALB. – Jatin Mehrotra Apr 02 '21 at 11:18
  • @JatinMehrotra There could be other rules in the instance SG? Instances can have multiple SGs as well. – Marcin Apr 02 '21 at 11:20
  • 2
    @JatinMehrotra I think you might be missing something. If the instances allow inbound traffic only from some SG which is not from ALB, there is no way they could be accessed by ALB. Maybe you could add some screenshot to your question with details of the setup? – Marcin Apr 02 '21 at 11:24
  • Will update as another question with images. – Jatin Mehrotra Apr 02 '21 at 14:39