EC2 Security Group inbound rule not working as expected

Question

I have an instance that hosts a mongodb service and I am trying to allow incoming traffic for port 27017 from an autoscaling group of instances. I am adding the security group (that has the AG instances) I want to access the specific instance, but I see it times out.

Inbound rule:

I have tried allowing a specific address or 0.0.0.0 and it works. Only when I am specifying the security group id it doesn't work.

Any help on this highly appreciated.

Answer 1

Assuming that you also have a Load Balancer, you would want three security groups:

• ELB-SG: Allow incoming web traffic as appropriate (eg 80, 443). Associate it with the Load Balancer.
• App-SG: Allow incoming traffic from ELB-SG. Associate it with the Auto Scaling Group, which will automatically assign it to the instances launched via Auto Scaling.
• Mongo-SG: Allow incoming traffic from App-SG on port 27017. Associate it with the instance running Mongo.

Basically, have the security groups reference another Security Group and they will automatically accept traffic from instances associate with that other security group.