CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2
Ryan Lyu
Ryan Lyu

Reputation: 5135

AWS: When specifying a security group to an instance, is its ENI specified the security group under the hood?

Here I have an AWS instance that has been specified with two security group default① and my first group②.

Now I would like to make this instance ssh available. Both the following ways work:

Are they same?

When specifying an security group to an instance, is its eni specified a security group under the hood?

enter image description here

Upvotes: 9

Views: 6957

Answers (2)

Chris Williams
Chris Williams

Reputation: 35238

To add to Johns great comment, this makes sense when you think that Security Groups are not just bound to EC2 instances, in fact any resource with an ENI can have a security group attached with examples such as:

  • VPC Interface Endpoints
  • RDS
  • ElastiCache
  • ElasticSearch Service
  • And many more

By having a single implementation of security group -> ENI, I would imagine it makes it easier for AWS to implement networking security for new VPC based resources over time.

Upvotes: 8

John Rotenstein
John Rotenstein

Reputation: 269826

Yes. Security Groups are attached to Elastic Network Interfaces (ENIs). That's why the console shows it under the Networking tab.

This design allows different security settings if there are multiple ENIs. For example, one ENI could be used for external traffic and a different ENI could be used for internal traffic.

Most Amazon EC2 instances only have one ENI, so it is easier to think of the Security Group as being associated with the instance.

Upvotes: 18

Related Questions