AWS EC2: Security Groups

What is a Security Group?

A security group is a collection of rules which control the traffic into and out of an AWS resource.

Rules come in two flavours:

• inbound rule (or ingress rule) — controls inbound traffic to the resource; and
• outbound rule (or egress rule) — controls outbound traffic from the resource.

A security group also has the following attributes:

• name
• description
• VPC
• ID (something like sg-08e590f76b7380bd7 which is automatically assigned) and
• tags (optional).

🚨 Your account will have a distinct set of security groups for each AWS region.

Defining a Security Group

1. Go to the EC2 Dashboard.
2. Select Security Groups from the menu.
3. Press Create security group.
4. Press the Add rule in either the Inbound rules or Outbound rules section.
5. Fill in the details of the rule.
6. Repeat the previous two steps until you’ve added all of the required rules. You can add multiple rules to a single security group.

7. Press Create security group.

Security Group Mayhem

AWS will helpfully create new security groups for you. I used to absently let AWS just create a security group for each new new resource. This was a mistake. My account became cluttered with a random assortment of old security groups. There was no system. Complete disorder.

Curated Security Groups

I’ve come to appreciate the value of a curated collection of security groups. Here’s a sample of the ones I’ve set up:

• exodus — outbound traffic on all protocols to all ports anywhere;
• http — inbound TCP traffic on port 80;
• https — inbound TCP traffic on port 443;
• ssh — inbound TCP traffic on port 22;
• openvpn — inbound TCP traffic on port 443 and UDP traffic on port 1194;
• shiny — inbound TCP traffic on port 3838; and
• flask — inbound TCP traffic on port 5000.

Some details below.

Exodus

This is a simple security group which allows outbound traffic on all ports to all destinations. The rule is defined using the All traffic type and the Anywhere destination.

📢 You can use the aws CLI tool to inspect the details of a security group. Make sure that you’ve got it installed and configured!

aws ec2 describe-security-groups --group-ids sg-08e590f76b7380bd7

{
    "SecurityGroups": [
        {
            "GroupName": "exodus",
            "Description": "All outbound ports",
            "GroupId": "sg-08e590f76b7380bd7",
            "IpPermissionsEgress": [
                {
                    "IpProtocol": "-1",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            ]
        }
    ]
}

The permissions do not specify a protocol or port, and the IP range 0.0.0.0/0 matches all addresses in the IPv4 address space.

HTTPS & HTTPS

This pair of security groups allows inbound access on ports 80 & 443. The rules are defined using the HTTP and HTTPS types and the Anywhere source.

{
    "SecurityGroups": [
        {
            "GroupName": "https",
            "Description": "HTTPS",
            "IpPermissions": [
                {
                    "FromPort": 443,
                    "ToPort": 443,
                    "IpProtocol": "tcp",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            ]
        },
        {
            "GroupName": "http",
            "Description": "HTTP",
            "IpPermissions": [
                {
                    "FromPort": 80,
                    "ToPort": 80,
                    "IpProtocol": "tcp",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            ]
        }
    ]
}

The permissions specify both protocol and port, and apply to all destination addresses.

Shiny

This security group, which allows inbound access on port 3838, is defined using the Custom TCP type and the Anywhere source.

{
    "SecurityGroups": [
        {
            "GroupName": "shiny",
            "Description": "Shiny",
            "IpPermissions": [
                {
                    "FromPort": 3838,
                    "ToPort": 3838,
                    "IpProtocol": "tcp",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            ]
        }
    ]
}

Flask

This security group, which allows inbound access on port 5000, is defined using the Custom TCP type and the Anywhere source.

{
    "SecurityGroups": [
        {
            "GroupName": "flask",
            "Description": "Flask",
            "IpPermissions": [
                {
                    "FromPort": 5000,
                    "ToPort": 5000,
                    "IpProtocol": "tcp",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ]
                }
            ]
        }
    ]
}

Conclusion

Establishing a clean, curated set of security groups will allow you to quickly and easily control access to your AWS resources.