CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-ec2
Praxis
Praxis

Reputation: 964

Secure connection from S3 to EC2 on AWS

I'm sure this is a fairly simple question regarding EC2 and S3 on AWS.

I have a static website hosted on S3 which connects to a MongoDB server on an EC2 instance which I want to secure. Currently it's open to all of the internet 0.0.0.0/0 on port 27017, which is the MDB default. I want to restrict the inbound traffic to only requests from the S3 static web site however for security reasons. Apparently S3 does not supply fixed addresses which is causing a problem.

My only thought was to open the port to all IP ranges for the S3 region I am in. This doc on AWS explains how to find these. Although they are subject to change without notice.

http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

Would this be the way to proceed or am I missing something obvious here. Another way to assign an IP to S3 perhaps?

Upvotes: 0

Views: 337

Answers (3)

Naveen Kerati
Naveen Kerati

Reputation: 971

s3 wont request your mongodb server on ec2 instance . From my understanding your js files in browser would request the mongodb running on ec2 instance . In that case you have to add message headers in the mongodb configuration files to allow CORS .

CORS: enter link description here

Upvotes: 0

helloV
helloV

Reputation: 52393

S3 is a storage service, not a compute service so it cannot make a request to your MongoDB. When S3 serves static webpages, your browser will render it and when a user clicks on a link to connect to your MongoDB, the request goes to MongoDB from the user's computer.

So MongoDB sees the request coming from the user's IP. Since you do not know where the user is coming from (or the IP range), you have no choice but to listen to traffic from any IP.

Upvotes: 1

Amith Jayasekara
Amith Jayasekara

Reputation: 439

I think it is not possible to allow only for your s3 hosted site to access your DB inside the ec2 since s3 does not offer an IP address for you.

So its better to try an alternative solution such as instead of directly access DB, proxy through a https service inside your ec2 and restrict the inbound traffic for your mondo db port

Upvotes: 0

Related Questions