AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

Can't access Instance using custom network acl * security group rules

0

Hi,

I have just moved from GCP to AWS to test out CodePipeline / CodeDeploy / and S3. I was following this documentation: "Tutorial: Create a simple pipeline (S3 bucket)" and I have encountered some issues with this step [1]. Apparently de pipeline I have created failed because it coudn't access my EC2 instance.

Taking the above information into consideration, I deleted the pipeline to start fresh and I explored the EC2 service more. To sum up, I have observed that when I configure the securitygroup to use my IP instead of allow all, or if I try to use any custom rule, any attempt to access that instance will fail, SSH, ping. anything.

I tried to add the same rules to Network ACLs and also I have created a Internet Gateway but nothing changed.

Key Information:

  • EC2 instance: second VM test
  • Zone: eu-west-3c
  • Security Group Name: launch-wizard-2

[1]: Step where issue was encountered

https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-simple-s3.html#:~:text=Under%20Network%20settings%2C%20do%20the%20following.

  • joahna
    2년 전

    When you use the same security group (launch-wizard-2), but with an allow all IP addresses (for SSH port), you're able to connect to the instance?

  • rePost-User-7702878
    2년 전

    Hi Joahna,

    Yes, I am able to. This is the reason why I find this behaviour strange

주제
네트워킹 및 콘텐츠 전송컴퓨팅
태그
아마존 VPC아마존 EC2보안 그룹
언어
English
rePost-User-7702878
질문됨 2년 전281회 조회
1개 답변
0

Can you set the Security Inbound rule to open to internet and then ssh into the EC2 machine and then type "who am i" on the EC2 terminal. It should give you the IP address of the ssh client. Now modify the Security Group to use that IP instead of the IP address that you get from a website like whatsmyip. I just tested it and it worked.

profile pictureAWS
전문가
Indranil Banerjee AWS
답변함 2년 전
  • rePost-User-7702878
    2년 전

    Thank you for your response. It works now but can you explain why is this the case? What is this IP? It a proxy of some sort in the middle? This IP is the same for all instances or I need to manualy find out the IP every time I create a new instance?

  • Indranil Banerjee AWS 전문가
    2년 전

    Unless you have a static IP address, the IP could change. I connect over VPN and my iP changed between yesterday and today from a.b.c.d to a.b.c.d+1, so if I had specified a.b.c.0/24 instead of a.b.c.d/32, I would be good. If I disconnect from the VPN then the IP matches what is shown on whatsmyip, which is my ISP assigned IP address, which is assigned using DHCP and also can change. So if you want to be very secure, you should get a static IP or connect from your corporate network.

    The IP that you put in the security group is the IP of the client machine from where you are connecting and will be the same for multiple EC2 machines.

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠