How do I restrict access to SSH port 22 in my Elastic Beanstalk instance security group to a specific CIDR or security group?

Resolution

Note: Elastic Beanstalk uses AWS CloudFormation to manage resources. If you manually change an Amazon EC2 instance outside of CloudFormation, then errors might occur.

To restrict access to a specific CIDR range or security group, configure the following settings.

Restrict SSH access to a specific CIDR range

Complete the following steps:

1. Create a config file that has the following settings:

   option_settings:  
      aws:autoscaling:launchconfiguration:    
         SSHSourceRestriction: tcp, 22, 22, my-cidr-range

   Note: Replace my-cidr-range with your CIDR range.

2. Move the file to the .ebextensions folder in the root of the application source bundle:

   .ebextensions/SSHSourceRestriction.config

3. Deploy the source bundle to the environment.

Restrict SSH access to a specific security group

Complete the following steps:

1. Create a config file that has the following settings:

   option_settings:  
      aws:autoscaling:launchconfiguration:    
         SSHSourceRestriction: tcp, 22, 22, my-security-group

   Note: Replace my-security-group with your security group name.

2. Move the file to the .ebextensions folder in the root of the application source bundle:

   .ebextensions/SSHSourceRestriction.config

3. Deploy the source bundle to the environment.

Related information

elastic-beanstalk-samples on the GitHub website