EC2: Security Group Firewall Rules in Different Regions Using AutoScaling

Question

For geographic redundancy and performance, we're going to create multiple EC2 servers in several regions that will scale up and down on demand using Amazon AutoScaling. However, we have a somewhat unique requirement that each server in all regions should be able to communicate with each other. Although it is fairly simple to configure a firewall to allow this in one region, it is not clear how to achieve this in different regions, since links to security groups in the firewall from other regions are not supported.

Does anyone know what is best to ensure that all of our servers have access to each other on a specific port? Remember that servers will be added and removed by Amazon AutoScaling, so manually entering IP addresses will become outdated pretty quickly. I hope there is a way to achieve this configuration, rather than making API calls every time a server is added or removed by AutoScaling.

Answer 1

I do not think this is possible. You can try to use the security group identifier instead of the name, but I'm not sure if they work in different regions. I just tried this and couldn't make it work. The rule was created just fine, but there is no guarantee that the security group that I added is actually from my account, since you can actually add security groups through accounts. This is most likely possible using a VPN connection, if you have one, since a VPN gives you much more control over the firewall rules, however I never tried.

All this is said. I think you should review the requirements of your application. I don’t know why you need to connect between the two regions, I understand that your goal is to achieve geographical redundancy. However, requiring two environments to connect to each other, I chose the red flag for me when considering failover. If you are surrounded by an environment, you run the risk of getting a complete failure, even if one environment does not work. What purpose, besides latency or fault tolerance, launches copies in two regions? My point is that if servers need a rule in a security group, your environments are probably too connected and you will not get the benefits of having two geographical locations.

Each of the EC2 regions is isolated to help ensure decisive architectural decisions. They also want to isolate any problems with one region, which you should also strive for.