Skip to main content

AWS Security Groups: Instance Level Security

Instance security requires that you fully understand AWS security groups, along with OS patch protocols, key pairs, and your various tenancy options.

Moving on from last week’s AWS Shared Responsibility Model post, I’d like to discuss instance level security within your Virtual Private Cloud (VPC). I will describe AWS security groups and how they are used to protect your EC2 instances in some depth. We’ll also explore applying security patches to your instances, multi-tenancy vs. dedicated deployments, and the proper use of EC2 Key Pairs.

From last week’s blog, you will remember that instance level security is your responsibility, and that AWS provides you with the tools you’ll need completely control access to your instances.

If you were to adopt only one of those tools as a result of this article, I would suggest that it should be AWS security groups. Security groups are easy to set up, easy to manage, and add a great deal of security to your resources.

AWS security groups and cloud security

AWS security groups (SGs) are associated with EC2 instances and provide security at the protocol and port access level. Each security group –  working much the same way as a firewall – contains a set of rules that filter traffic coming into and out of an EC2 instance. There are no ‘Deny’ rules. Rather, if there is no rule that explicitly permits a particular data packet, it will be dropped.
Create a Security Group screenshot
Each security group must have a name, allowing you to easily identify it from account menus. It’s always a good idea to choose a descriptive name that will quickly tell you this group’s purpose. In fact, you would be well served to define and use a consistent convention for naming all objects in your AWS account.

Security groups exist within individual VPCs. When you create a new group, make sure that it’s in the same VPC as the resources it’s meant to protect.

AWS Security Groups: rules

The actual rule set that filters traffic is made up of two tables: ‘Inbound’ and ‘Outbound’. AWS Security groups are stateful, meaning you do not need the same rules for both outbound traffic and inbound. Therefore any rule that allows traffic into an EC2 instance, will allow responses to pass back out without an explicit rule in the Outbound rule set.

Each rule is comprised of four fields: ‘Type’, ‘Protocol’, ‘Port Range’, and ‘Source’. This applies for both ‘Inbound’ and ‘Outbound’ rules.
AWS security groups rules screenshot

  • Type. The drop down list allows you to select common protocols like SSH, RDP, or HTTP. You can also choose custom protocols.
  • Protocol. This is typically greyed out, as it’s covered by most ‘Type’ choices. However, if you create a custom rule, you can specify your protocol (TCP/UDP etc.) here.
  • Port Range. This value will also usually be pre-filled, reflecting the default port or port range for your chosen protocol. However, there might be times when you prefer to use custom ports.
  • Source. This can be a Network Subnet range, a specific IP address, or another AWS security group. You can also leave access open to the entire Internet using the ‘Anywhere (0.0.0.0/0)’ value.

Creating AWS Security Groups

You can create security groups in a number different ways, including at the sixth step of the creation of a new Instance:
Configuring an AWS security group screenshot
…From the Console under ‘EC2 > Network & Security > Security Groups > Create Security Group’:Create AWS security groups screenshot
…Or even through the AWS CLI.

While AWS security groups are normally associated with instances on start up, you can also add or remove them from running instances through the AWS Console. Again, go to ‘EC2 > Instances’, select the instance you want to modify, and click Actions > Networking > Change Security Groups’.

Limits

Before building a complex plan that involves creating large numbers of security groups within a single VPC, be aware that you are limited to only 100 security groups per VPC. You can request that AWS increases the limit, but you may notice a network performance impact.

There is also a limit of 250 rules per network interface on your instances. With this in mind, you could create five security groups with 50 rules each, or ten security groups with 25 rules in each. As long as you stay below the overall limit of 250. Also, it’s worth noting that you can’t have more than sixteen security groups per network interface.

OS Patch Management

Applying the latest security patches to your instances is, again, your responsibility – even if you built your instance from an AWS defined AMI. No matter which operating system you deploy, I recommend that you regularly download the latest security patches. New bugs and security flaws are being discovered and fixed all the time, and you just can’t afford to ignore them.

I also suggest that you apply the latest patches immediately after creating an instance. You could look at automating this process through instance User data when creating your instances. For example entering the following on a Linux based AMI would automatically perform a Yum update at instance launch:

#!/bin/bash
yum update

The ‘User data’ section can be found in ‘Step 3: Configure Instance Details’ under Advanced Details:
Configure Instance Details screenshot
Ensuring the latest patches are installed on your instances, protects you from vulnerabilities and threats to your OS. This is a simple yet necessary security addition to your instance rollouts.

Multi-tenancy vs Dedicated

When deploying your Instances through the Console you will be asked which ‘Tenancy’ type you want for your instance:
Configure AWS instance details tenancy dropdown
Your two choices are ‘Shared Tenancy (Multi-Tenant Hardware)’ or ‘Dedicated Tenancy (Single-Tenant Hardware)’.

Shared Tenancy is when your instance will be hosted on shared hardware. This means there might be other AWS customers running their instances on the same physical server. You will never know who those customers are or how many of them there might be, but they will be equally ignorant about you. Security and separation are managed at the Hypervisor layer, where AWS maintains operational control and support. AWS guarantees that there will be no data crossover between account resources.

The major advantage of Shared Tenancy is its lower cost. This is the product of the fact that there is no need for AWS to isolate hardware for your explicit use…which, incidentally, is the definition of ‘Dedicated Tenancy’. If you are not happy sharing hosts, or need additional physical security separation, then select Dedicated Tenancy.

Not all instance types are eligible for Dedicated Tenancy, so if you are thinking of using it, consult the AWS documentation.

EC2 Key Pairs

If you plan to remotely log into your EC2 instances, then you’ll need to create key pairs and associate them with your instances. A key pair consists of a public key and a private key. The public key is kept on your instance, while the private key must be available only to you, and will generally live on your local PC. AWS will not keep a copy of the private key. You will only be able to directly connect to your instance by invoking the private key. Public-key cryptography is used to encrypt/decrypt both keys.

These keys provide an added layer of security ensuring only people and resources holding the private key are allowed to make API calls to the instance. I suggest you download and keep a secure copy of your private key when prompted during your instance launch, as you will not be allowed to access your instance if you lose it.

When creating a new EC2 instance, you must specify which key pair you wish to associate. If you want to use a brand new key pair, you can create and configure one during this selection process.
Select existing key pairs or create a new key pair screenshot
There are a number of ways to create new key pairs. You can use the AWS Console, the AWS CLI, or Windows PowerShell. AWS uses 2048-bit SSH-2 RSA keys, with a limit of up to 5000 pairs per AWS Region.

Should you wish to create your own key pairs outside of AWS, they must be RSA compliant. EC2 will accept OpenSSH, Base64 encoded DER, and SSH Public key formats as per RFC4716. More information on how to create and import your own Keys can be found here.

Let’s review what we’ve seen.

  • Instance level security is your responsibility and it’s up to you to implement as much or as little as you see fit for your purpose. I recommend implementing security groups as tightly as possible. I have seen people leaving themselves vulnerable to attacks through wide open security groups.
  • Implement a Patch Management policy/strategy when deploying your instances – either manually or automatically via User Data.
  • Weigh the additional security against the cost when deciding on your instance tenancy (i.e., Shared vs. Dedicated): do you really need the additional physical separation of Dedicated Tenancy?
  • Finally, understand and manage your EC2 instance key pairs and keep your private keys safe to ensure you can connect to your instances via API calls using protocols like  SSH and RDP.

You might also want to take Cloud Academy’s Introduction to Security Best Practices course for more useful information.

Next week I plan to address more Virtual Private Cloud (VPC) security concepts, focusing on network level security. I will explain how to set up and implement Network ACLs and how they can be used to control network traffic and prevent DDOS attacks at the network level. I will also touch on the proper use of private and public subnets within your environment, along with Bastion hosts, NAT instances, and VPC Peering.

Thank you for taking the time to read my article. If you have any feedback please do leave a comment below.

Avatar

Written by

Stuart Scott

Stuart is the AWS content lead at Cloud Academy where he has created over 40 courses reaching tens of thousands of students. His content focuses heavily on cloud security and compliance, specifically on how to implement and configure AWS services to protect, monitor and secure customer data and their AWS environment.

Related Posts

Sam Ghardashem
Sam Ghardashem
— May 15, 2019

Aviatrix Integration of a NextGen Firewall in AWS Transit Gateway

Learn how Aviatrix’s intelligent orchestration and control eliminates unwanted tradeoffs encountered when deploying Palo Alto Networks VM-Series Firewalls with AWS Transit Gateway.Deploying any next generation firewall in a public cloud environment is challenging, not because of the f...

Read more
  • AWS
Joe Nemer
Joe Nemer
— May 3, 2019

AWS Config Best Practices for Compliance

Use AWS Config the Right Way for Successful ComplianceIt’s well-known that AWS Config is a powerful service for monitoring all changes across your resources. As AWS Config has constantly evolved and improved over the years, it has transformed into a true powerhouse for monitoring your...

Read more
  • AWS
  • Compliance
Avatar
Francesca Vigliani
— April 30, 2019

Cloud Academy is Coming to the AWS Summits in Atlanta, London, and Chicago

Cloud Academy is a proud sponsor of the 2019 AWS Summits in Atlanta, London, and Chicago. We hope you plan to attend these free events that bring the cloud computing community together to connect, collaborate, and learn about AWS. These events are all about learning. You can learn how t...

Read more
  • AWS
  • AWS Summits
Paul Hortop
Paul Hortop
— April 2, 2019

How to Monitor Your AWS Infrastructure

The AWS cloud platform has made it easier than ever to be flexible, efficient, and cost-effective. However, monitoring your AWS infrastructure is the key to getting all of these benefits. Realizing these benefits requires that you follow AWS best practices which constantly change as AWS...

Read more
  • AWS
  • Monitoring
Joe Nemer
Joe Nemer
— April 1, 2019

AWS EC2 Instance Types Explained

Amazon Web Services’ resource offerings are constantly changing, and staying on top of their evolution can be a challenge. Elastic Cloud Compute (EC2) instances are one of their core resource offerings, and they form the backbone of most cloud deployments. EC2 instances provide you with...

Read more
  • AWS
  • EC2
Avatar
Nitheesh Poojary
— March 26, 2019

How DNS Works – the Domain Name System (Part One)

Before migrating domains to Amazon's Route53, we should first make sure we properly understand how DNS worksWhile we'll get to AWS's Route53 Domain Name System (DNS) service in the second part of this series, I thought it would be helpful to first make sure that we properly understand...

Read more
  • AWS
Avatar
Stuart Scott
— March 14, 2019

Multiple AWS Account Management using AWS Organizations

As businesses expand their footprint on AWS and utilize more services to build and deploy their applications, it becomes apparent that multiple AWS accounts are required to manage the environment and infrastructure.  A multi-account strategy is beneficial for a number of reasons as ...

Read more
  • AWS
  • Identity Access Management
Avatar
Sanket Dangi
— February 11, 2019

WaitCondition Controls the Pace of AWS CloudFormation Templates

AWS's WaitCondition can be used with CloudFormation templates to ensure required resources are running.As you may already be aware, AWS CloudFormation is used for infrastructure automation by allowing you to write JSON templates to automatically install, configure, and bootstrap your ...

Read more
  • AWS
  • CloudFormation
Badrinath Venkatachari
Badrinath Venkatachari
— February 1, 2019

10 Common AWS Mistakes & How to Avoid Them

Massive migration to the public cloud is changing architecture patterns, operating principles, and governance models. That means new approaches are vital to get a handle on soaring cloud spend. Because the cloud’s short-term billing cycles call for financial discipline, you must empower...

Read more
  • AWS
  • Operations
Avatar
Andrew Larkin
— January 24, 2019

The 9 AWS Certifications: Which is Right for You and Your Team?

As companies increasingly shift workloads to the public cloud, cloud computing has moved from a nice-to-have to a core competency in the enterprise. This shift requires a new set of skills to design, deploy, and manage applications in cloud computing.As the market leader and most ma...

Read more
  • AWS
  • AWS Certifications
Avatar
Andrew Larkin
— January 15, 2019

2018 Was a Big Year for Content at Cloud Academy

As Head of Content at Cloud Academy I work closely with our customers and my domain leads to prioritize quarterly content plans that will achieve the best outcomes for our customers.We started 2018 with two content objectives: To show customer teams how to use Cloud Services to solv...

Read more
  • AWS
  • Azure
  • Cloud Computing
  • Google Cloud Platform
Avatar
Jeremy Cook
— November 29, 2018

Amazon Elastic Inference – GPU Acceleration for Faster Inferencing

“Add GPU acceleration to any Amazon EC2 instance for faster inference at much lower cost (up to 75% savings)”So you’ve just kicked off the training phase of your multilayered deep neural network. The training phase is leveraging Amazon EC2 P3 instances to keep the training time to a...

Read more
  • AWS
  • Elastic Inference
  • re:Invent 2018