Programming Amazon Web Services

Network Security by IP

When you launch an EC2 instance, the first thing you will generally want to do is log in to it over a Secure Shell connection to run programs on the instance and control what it is doing. In our discussion of keypairs, we demonstrated how to create the public and private key pair credentials you will need to authenticate yourself to your instances, but there is an extra step required before you can log in. You must configure your network security firewall settings to allow network connections to reach your instances.

Network security in EC2 is managed using security groups. Security groups are collections of rules that describe exactly what kind of incoming network connections the EC2 environment should permit to reach your instances. Any network traffic sent to an EC2 instance that is not explicitly allowed by a security group rule will be discarded before it ever reaches the instance. There are two classes of access rules you can apply: rules that permit network traffic from other EC2 instances inside Amazon’s AWS network and rules that permit traffic from outside, such as from computers on the Internet.

To get an instance up and running without delay, we will save a full discussion of the EC2 service’s network security capabilities and API for later in this chapter, in the Security Groups” section. For now, let us concentrate on configuring the security group rules you will need to interact with the instances you launch.

When your EC2 account was created, ...