self referencing aws security groups

Question

my application has ELB, NGNIX and ECS in the web component layer and I am grouping all of them in to one security group and there is internal communication between ELB, NGNIX and ECS. I wanted to create self referential ports for the communication between these three, do i have to write self ingress rule or self outgress rule for this communication is the internal communication between these three inbound or outbound?

Answer 1

The default Outbound security groups permit all traffic, so never change them unless you have a specific network requirement (such as enforcing additional restrictions to meet compliances).

You can configure a Security Group to permit Inbound connections from itself (that is, the security group has its own ID as the Source of the inbound connection). This would enable any Amazon EC2 instance that is associated with the security group to communicate with any other Amazon EC2 instance that is associated with the same security group (on the given port).

The important thing to note is that security groups are enforced at the instance level rather than traditional firewalls that work at the network level. Thus, there is no concept of multiple instances being "inside a security group". Rather, the security group is applied against traffic as it goes into each instance. Thus, the need to allow incoming connections from 'itself'.

Answer 2

A security group can be made to allow traffic from itself, however the SecurityGroup resource and its ingress rule need to be separated to avoid a circular dependency. For example;

ConsumerSG:
  Type: 'AWS::EC2::SecurityGroup'
  Properties:
    VpcId: !ImportValue EnvVpc
    GroupDescription: !Sub 'Security group which grants access to consuming apps'


ConsumerSGIngress:
  Type: 'AWS::EC2::SecurityGroupIngress'
  DependsOn: ConsumerSG
  Properties:
    GroupId: !Ref ConsumerSG
    IpProtocol: tcp
    FromPort: '5000'
    ToPort: '5000'
    SourceSecurityGroupId: !Ref ConsumerSG

This creates a security group which allows access from itself on port 5000