Security Groups & Networking

EC2 networking is built on VPC. Security groups are the primary firewall at the instance level. Understanding Elastic IPs, ENIs, and subnet placement is required for reliable, secure architectures.

Security Groups

# Security groups are STATEFUL firewalls — return traffic is automatically allowed
# All outbound traffic is allowed by default
# All inbound traffic is denied by default (you add explicit allow rules)
# Multiple SGs can be attached to one instance (rules are unioned)

# Create a security group
aws ec2 create-security-group \
  --group-name web-server-sg \
  --description "HTTP/HTTPS and SSH access" \
  --vpc-id vpc-0abc123def456789

# Add inbound rules
# Allow HTTP from anywhere
aws ec2 authorize-security-group-ingress \
  --group-id sg-0a1b2c3d4e5f67890 \
  --protocol tcp --port 80 --cidr 0.0.0.0/0

# Allow HTTPS from anywhere
aws ec2 authorize-security-group-ingress \
  --group-id sg-0a1b2c3d4e5f67890 \
  --protocol tcp --port 443 --cidr 0.0.0.0/0

# Allow SSH from your IP only
aws ec2 authorize-security-group-ingress \
  --group-id sg-0a1b2c3d4e5f67890 \
  --protocol tcp --port 22 --cidr $(curl -s https://checkip.amazonaws.com)/32

# Allow traffic from another security group (e.g. app tier to DB tier)
aws ec2 authorize-security-group-ingress \
  --group-id sg-db123 \
  --protocol tcp --port 5432 \
  --source-group sg-app456

# SG vs NACL:
# Security Group: instance-level, stateful, allow rules only
# NACL (Network ACL): subnet-level, stateless, allow + deny rules, processed in order by rule number

Elastic IP & ENI

# Elastic IP — static public IPv4 address you own
# Charged when NOT associated with a running instance

# Allocate an Elastic IP
aws ec2 allocate-address --domain vpc

# Associate with an instance
aws ec2 associate-address \
  --instance-id i-1234567890abcdef0 \
  --allocation-id eipalloc-0abc123def456789

# Disassociate and release
aws ec2 disassociate-address --association-id eipassoc-0abc123def456789
aws ec2 release-address --allocation-id eipalloc-0abc123def456789

# ENI (Elastic Network Interface) — virtual NIC
# Each instance has a primary ENI; you can attach additional ones
# Secondary ENIs can be moved between instances (useful for failover)

# Create a secondary ENI in a specific subnet
aws ec2 create-network-interface \
  --subnet-id subnet-0bb1c79de3EXAMPLE \
  --groups sg-0a1b2c3d4e5f67890 \
  --description "secondary interface"

# Attach to instance
aws ec2 attach-network-interface \
  --network-interface-id eni-0abc123def456789 \
  --instance-id i-1234567890abcdef0 \
  --device-index 1

# Describe network interfaces
aws ec2 describe-network-interfaces \
  --filters "Name=attachment.instance-id,Values=i-1234567890abcdef0"

VPC Placement & NAT Gateway

# Public subnet: has route to Internet Gateway (IGW) — instances can have public IPs
# Private subnet: no route to IGW — instances need NAT Gateway for outbound internet

# Typical 3-tier VPC layout:
# Public subnets:  Load balancers, bastion hosts
# Private subnets: Application servers (EC2)
# Private subnets: Databases (RDS), caches (ElastiCache)

# Create a NAT Gateway in a public subnet (for private subnet outbound access)
aws ec2 create-nat-gateway \
  --subnet-id subnet-public-0abc123 \
  --allocation-id eipalloc-0abc123def456789   # Elastic IP for the NAT GW

# Update route table for private subnet to use NAT GW
aws ec2 create-route \
  --route-table-id rtb-0abc123def456789 \
  --destination-cidr-block 0.0.0.0/0 \
  --nat-gateway-id nat-0abc123def456789

# Check reachability from a private instance via NAT
# (from inside the instance)
curl -s https://checkip.amazonaws.com   # Should return NAT GW's EIP

# Placement Groups — control physical placement of instances
# cluster:  all in same rack (lowest latency, 10 Gbps between instances)
# spread:   different hardware (max HA, max 7 instances per AZ per group)
# partition: separate racks per partition (Hadoop, Cassandra, Kafka)
aws ec2 create-placement-group --group-name my-cluster --strategy cluster
aws ec2 run-instances --placement "GroupName=my-cluster" ...