Control peering traffic with security groups

Traffic between two peered VPCs passes through each VPC’s gateway, and the security groups on the gateway decide what gets through. When you create a peering connection, E2E puts the group the connection needs on both gateways, so a new connection works with no setup. Attach your own groups when you want to narrow it, for example to let only your application’s port cross from one network to the other.

The resource at the other end still applies its own security groups, so they need to allow traffic from the first VPC’s range as well; see Add or edit rules.

Before you begin

• A VPC with a peering connection. See Peer two VPCs.
• The security group you want on the gateway, with rules for the traffic you mean to allow. To make one, see Create a security group. Its rules need to keep allowing traffic from the other VPC’s gateway. That gateway’s public IP is under Network Gateway on the other VPC’s VPC Details tab.

Attach a security group to the gateway

1. Open Network > VPC, select the VPC, and open its Security Groups tab. It lists the groups on the VPC’s gateway, each with its description.
2. Click Attach Security Group, choose one or more groups from the list, and click Attach.

A message confirms the change, and the groups join the list. Attaching your own group takes E2E’s default group off the gateway, so from now on your groups’ rules decide what crosses. Do the same on the other VPC if you want the rules on both sides.

To change a group’s rules later, click the edit icon beside it. The group opens in Manage Security Groups; see Add or edit rules.

Open all traffic while you find a problem

If the connection stops passing traffic after you change the gateway’s groups, click Allow All Traffic on the Security Groups tab. It adds a group that lets all traffic in and out of the gateway, so you can check whether a rule is the cause, and it stays attached until you detach it. Detach it as soon as you have fixed your rules.

Detach a security group

Next to the group, click Detach, then Confirm. The gateway always keeps at least one group, so detaching the last one shows “At least one security group is mandatory, attach another to detach this one.” Attach its replacement first.

Check the result from a resource on one side: the traffic your groups allow still reaches the other VPC, and the rest does not. Troubleshooting VPC lists what else to check when traffic stops that should get through.