How do I restrict access to SSH port 22 in my Elastic Beanstalk instance security group to a specific CIDR range or security group?

Resolution

Note: Elastic Beanstalk uses AWS CloudFormation to manage resources. If you manually change an Amazon EC2 instance outside of CloudFormation, then errors might occur.

Restrict SSH access to a specific CIDR range

Complete the following steps:

1. Create a configuration file that has the following settings:

   option_settings:
       aws:autoscaling:launchconfiguration:    
           SSHSourceRestriction: tcp, 22, 22, my-cidr-range

   Note: Replace my-cidr-range with your CIDR range.

2. Add the file to the .ebextensions folder in the root of the application source bundle:

   .ebextensions/SSHSourceRestriction.config

3. Deploy the source bundle to the environment.

Restrict SSH access to a specific security group

Complete the following steps:

1. Create a configuration file that has the following settings:

   option_settings:
       aws:autoscaling:launchconfiguration:    
           SSHSourceRestriction: tcp, 22, 22, sg-0f69e4fd26ac48ec3
       aws:ec2:vpc:
           VPCId: vpc-09b7141f091e43ad4
           Subnets: subnet-093a0b2f2415060bc
           ELBSubnets: subnet-093a0b2f2415060bc

   Note: The preceding .ebextensions configuration file works with an Elastic Beanstalk environment that you create with defined virtual private cloud (VPC) configurations.

2. Add the file to the .ebextensions folder in the root of the application source bundle:

   .ebextensions/SSHSourceRestriction.config

3. Deploy the source bundle to the environment.

Related information

elastic-beanstalk-samples on the GitHub website