Security group setup stopped working (SMB shares)

hello, to resolve these issues, Check security group rules, network ACLs, Windows Firewall, network connectivity, and SMB share configuration to troubleshoot the loss of SMB share access on your EC2 instance.

Hey Hii,

It's unlikely that AWS made a recent change that specifically broke SMB access to your EC2 instance. Here I provide some steps to resolve it.

Security Group Rules:

=> Double-check your security group rules. Ensure inbound rules allow access on port 445 (TCP) from the specific IP addresses that previously accessed the SMB shares.

=>Verify no new rules were accidentally added that might be blocking traffic.

Firewalls:

=> Make sure the Windows Firewall on your EC2 instance is not blocking inbound traffic on port 445.

=> If you have additional firewalls on your network (e.g., corporate firewall), ensure they're not blocking SMB traffic to your EC2 instance.

SMB Share Configuration:

=> Confirm the SMB shares on the remote machine are still active and accessible. => Verify the credentials used for accessing the shares are valid.

Network Connectivity:

=> Check if your EC2 instance can ping the IP addresses of the SMB share machines. This helps verify basic network connectivity.

AWS documentation on Security Groups: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html

Documentation for Troubleshooting SMB access on Windows: https://learn.microsoft.com/en-us/partner-center/support/send-diagnostics

Hi,

Where is this two SMB file Shares running?

There are reasons why access to your SMB shares from an EC2 instance has stopped working. Here are some steps to troubleshoot the issue:

Security Group: Double-check the security group settings to ensure that the rules allowing access to the SMB shares have not been modified.

1. Go to the AWS Management Console.
2. Navigate to EC2 Dashboard > Security Groups.
3. Select the security group attached to your EC2 instance.
4. Verify that the inbound rules allow traffic on the ports to SMB file share IP (typically port 445).

Network ACLs: Verify that the Network ACLs associated with your VPC and subnets haven't changed. Network ACLs act as a firewall at the subnet level.

1. Go to the VPC Dashboard.
2. Navigate to Network ACLs.
3. Ensure the rules allow the necessary inbound and outbound traffic for SMB.

AWS virtually never makes changes like that. Search the CloudTrail logs in the region where the security group resides for the "Event name" "RevokeSecurityGroupIngress". If there are no hits, then search for "ModifySecurityGroupRules". If the rules you said were there got removed within the past 90 days, you'll see exactly who did it and when. You'll also see from the event data if the change was made via CloudFormation or Terraform, for example (in the case of Terraform, from the "User-Agent" header included in CloudTrail logs).