The instance is running and has a public IP, and nothing can reach it. Between the internet and every instance stands a security group: a firewall whose default is to let nothing in.
Rules
aws ec2 create-security-group --group-name web-sg --description "Market web servers"
aws ec2 authorize-security-group-ingress --group-name web-sg --protocol tcp --port 80 --cidr 0.0.0.0/0
aws ec2 describe-security-groups --group-names web-sg --query "SecurityGroups[0].IpPermissions"A group has inbound rules and outbound rules. Each rule names a protocol, a port or range, and a source (for inbound) or destination (for outbound). The source is a CIDR block, 0.0.0.0/0 for the whole internet, 203.0.113.0/24 for one office, or another security group. A new group allows all outbound and no inbound.
Stateful
Security groups are stateful: if a request is allowed in, the reply is allowed out, and vice versa, without a matching rule. You write rules for the direction a connection starts. Chapter 4 meets the stateless kind, where both directions need rules.
Attaching
aws ec2 run-instances … --security-group-ids sg-0abc…
aws ec2 modify-instance-attribute --instance-id i-… --groups sg-0abc… sg-0def…An instance has one or more groups; their rules add up. Groups are set at launch or changed afterwards with modify-instance-attribute --groups, which replaces the whole list.
Reading a timeout
curl: (28) Failed to connect to 54.23.117.9 port 80 after 3002 ms: Timeout was reachedA timeout means a firewall dropped the packet: no rule allowed it. Connection refused means the packet arrived and nothing was listening on that port. The difference tells you whether to look at the security group or at the process on the machine.
Groups as sources
aws ec2 authorize-security-group-ingress --group-name db-sg --protocol tcp --port 5432 --source-group web-sgA database group that allows 5432 from the web group lets every web instance in, now and in the future, with no IP addresses written anywhere. This is how tiers reference each other, and Chapter 7 uses it for the database.