Basically I need to be able to connect from one EC2 instance to another using SSH. I run the command ssh -i path-to-pem-file ec2-user@dns-address-of-ec2-instance, and it times out.

I set my security group to allow SSH inbound from the public IP address of my second EC2 instance, but it still doesn't work. I know that everything should be fine because when I set my SSH inbound traffic to "allow from anywhere" I can connect with no problems. Also I can connect to the EC2 instance from a home machine (I added my IP address to the security group) without any problems.

Obviously I can't leave my inbound traffic open to "allow from anywhere", but I can't seem to connect when I limit it to just the IP address of the second EC2 instance. Maybe the public IP address isn't what I should be putting into the security group?

I can't seem to ping it either; it just times out. Here is the result of ssh -vv -i path-to-pem-file ec2-user@dns-address-of-ec2-instance

OpenSSH_6.2p2, OpenSSL 1.0.1h-fips 5 Jun 2014
debug1: Reading configuration data /home/ec2-user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 50: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to dns-address [IP Address different from public ip] port 22.
debug1: connect to address [IP Address different from public ip] port 22: Connection timed out
ssh: connect to host dns-address port 22: Connection timed out

EC2 instances use an internal 10.X.X.X address (or other address if using a VPC), and traffic to their 'public' IP address is simply re-routed to the internal IP address. EC2 instances also use a different DNS server that is not publicly accessible. When you resolve the hostname of the other EC2 instance, because you're inside the AWS network, it gives you the instance's 10.X.X.X address instead of the public IP address. This prevents the traffic from having to go out to the internet and back in, which makes it faster.

Even if you could whitelist by IP address, this isn't a good idea as in EC2 classic mode, both your internal and public address can change. The proper solution is to whitelist by security group. You basically add a rule to the destination security group saying to allow port 22 from a specific origin security group.

If both instances are in the same account, you simply allow sg-1234abcd (where sg-1234abcd is the security group the origin instance is a member of). If they are in different accounts, include the account number, such as 111122223333/sg-1234abcd.
See documentation for additional information.

  • Perfect that is exactly what I was looking for! Works without a hitch! – Pompey Jul 21 '14 at 1:11
  • When speaking of security groups of different accounts, you need to make VPC peering so that you can reference them. See here: docs.aws.amazon.com/AmazonVPC/latest/PeeringGuide/… – Boris Strandjev Dec 20 '17 at 7:24
  • Just for completion, I wanted to add that AWS charges you for incoming traffic to a VPC from the internet, but traffic inside the VPC is free, so not going through the internet is not only faster but also cheaper. – Blueriver 16 hours ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.