EC2 security groups explained: how to open only what you need

In EC2, the firewall is not inside the machine but in front of it, and it is called a security group. It is a list of rules of the kind "let anyone in on port 443" or "let only this IP in on port 22". Anything not on the list doesn't get in. That is why a freshly created machine can be perfectly well running and yet the website doesn't load: nobody has opened the door.

Understanding four ideas about security groups avoids half of EC2's problems and most security holes. This guide explains them and leaves you with a well-configured group for a web server.

Step by step

1. See which group your machine has

   EC2 console, Instances, select the machine, Security tab. You will see the assigned group or groups and, below, the inbound rules as they apply. If the website doesn't respond, the answer is here in 90 % of cases: 443 is missing, or the source is only your IP.

2. Understand the default group

   Every network (VPC) has a group called default that allows all traffic between machines that share it and nothing from the internet. It is useful for your machines to talk to each other, but not for a public website. Don't edit it to open ports to the world: create your own groups with names that say what they are for.

3. Create a group for web servers

   Security Groups menu, Create security group. Name web-publica, a clear description, the default VPC. Inbound rules:

   Type	Port	Source	What for
   HTTPS	443	0.0.0.0/0 and ::/0	The secure website, for everyone
   HTTP	80	0.0.0.0/0 and ::/0	To redirect to HTTPS and renew certificates
   SSH	22	My IP	Administration, only from your connection

   The source dropdown has a My IP option, which fills in your current address. Add a description to each rule ("office", "Ana's home"): a year from now you will be glad to know whose IP each one was. Create.

4. Assign the group to the machine

   Go back to the instance, Actions, Security, Change security groups. Add web-publica and remove the one it had if it is no longer needed. The change is immediate, no reboot. Test the website and SSH.

5. For a database: open only to your machines

   If you have a machine or an RDS with a database, don't open 3306 to the internet or to "My IP". Create a group bd-interna with an inbound rule on port 3306 whose source is the security group web-publica (in the source dropdown you can choose a group instead of an IP). That way only the machines carrying that group can connect, whatever IP they have. It is the right way and the one almost nobody knows about.

6. Review the ones you already have

   In the security groups list, sort or filter for those with rules whose source is 0.0.0.0/0 on ports other than 80 and 443. A 22, a 3306 or a 3389 open to the whole internet is what attackers look for every day. Close them to your IP or to the appropriate group. And delete the groups not assigned to anything: they only confuse.

What can go wrong