使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post

Can't access Instance using custom network acl * security group rules

0

Hi,

I have just moved from GCP to AWS to test out CodePipeline / CodeDeploy / and S3. I was following this documentation: "Tutorial: Create a simple pipeline (S3 bucket)" and I have encountered some issues with this step [1]. Apparently de pipeline I have created failed because it coudn't access my EC2 instance.

Taking the above information into consideration, I deleted the pipeline to start fresh and I explored the EC2 service more. To sum up, I have observed that when I configure the securitygroup to use my IP instead of allow all, or if I try to use any custom rule, any attempt to access that instance will fail, SSH, ping. anything.

I tried to add the same rules to Network ACLs and also I have created a Internet Gateway but nothing changed.

Key Information:

  • EC2 instance: second VM test
  • Zone: eu-west-3c
  • Security Group Name: launch-wizard-2

[1]: Step where issue was encountered

https://docs.aws.amazon.com/codepipeline/latest/userguide/tutorials-simple-s3.html#:~:text=Under%20Network%20settings%2C%20do%20the%20following.

  • joahna
    2 年前

    When you use the same security group (launch-wizard-2), but with an allow all IP addresses (for SSH port), you're able to connect to the instance?

  • rePost-User-7702878
    2 年前

    Hi Joahna,

    Yes, I am able to. This is the reason why I find this behaviour strange

主題
網路與內容交付運算
標籤
Amazon VPCAmazon EC2安全性群組
語言
English
rePost-User-7702878
已提問 2 年前檢視次數 281 次
1 個回答
0

Can you set the Security Inbound rule to open to internet and then ssh into the EC2 machine and then type "who am i" on the EC2 terminal. It should give you the IP address of the ssh client. Now modify the Security Group to use that IP instead of the IP address that you get from a website like whatsmyip. I just tested it and it worked.

profile pictureAWS
專家
Indranil Banerjee AWS
已回答 2 年前
  • rePost-User-7702878
    2 年前

    Thank you for your response. It works now but can you explain why is this the case? What is this IP? It a proxy of some sort in the middle? This IP is the same for all instances or I need to manualy find out the IP every time I create a new instance?

  • Indranil Banerjee AWS 專家
    2 年前

    Unless you have a static IP address, the IP could change. I connect over VPN and my iP changed between yesterday and today from a.b.c.d to a.b.c.d+1, so if I had specified a.b.c.0/24 instead of a.b.c.d/32, I would be good. If I disconnect from the VPN then the IP matches what is shown on whatsmyip, which is my ISP assigned IP address, which is assigned using DHCP and also can change. So if you want to be very secure, you should get a static IP or connect from your corporate network.

    The IP that you put in the security group is the IP of the client machine from where you are connecting and will be the same for multiple EC2 machines.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

回答問題指南

相關內容