EC2 Deep Dive (Security Groups, Elastic IP)

Let's think about this for a second

A Security Group is a virtual firewall for an EC2 instance — it defines inbound rules (which ports/IPs are allowed in) and outbound rules (what the instance is allowed to reach). By default, all outbound traffic is allowed and all inbound traffic is blocked — you open up ports like SSH (22), HTTP (80), and HTTPS (443) only as needed (least privilege). An Elastic IP is a fixed public IP address you can attach to an EC2 instance — normally restarting an instance can change its public IP, but with an Elastic IP attached, the IP stays the same.

Let's connect this to a real scenario

If you open HTTP (80)/HTTPS (443) to 'anywhere' on a web server EC2 instance, but only open SSH (22) from your office IP — the public can browse your website, but attackers will have a hard time getting in via SSH. If you stop/start an instance repeatedly without an Elastic IP attached, its public IP can change — so if you've pointed a DNS record (Route 53) at it, you'll want an Elastic IP attached.

Security Group = a virtual firewall for an EC2 instance (inbound/outbound rules)
Least privilege = only open the ports/IPs you actually need
Elastic IP = a fixed public IP that doesn't change even when the instance restarts

Let's look at it together

bash

# Allow HTTP/HTTPS from anywhere, SSH only from your IP
aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 80 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 22 --cidr 203.0.113.10/32

# Allocate and associate an Elastic IP
aws ec2 allocate-address
aws ec2 associate-address --instance-id i-0123456789abcdef0 --allocation-id eipalloc-0123456789abcdef0

You should see

$ aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0
# Shows inbound rules: 80/tcp from 0.0.0.0/0, 22/tcp from 203.0.113.10/32

5-minute try-it

On the EC2 instance from the Basic chapter, open HTTP (80) in its Security Group, then allocate and associate an Elastic IP — stop/start the instance a couple of times and confirm the public IP doesn't change.

A quick word of caution

An Elastic IP not associated with an instance (idle) incurs a cost (while it's associated to a running EC2 instance, it's free) — keep the Free Tier limits in mind.