如何限制对ALB的访问，以使其仅从AWS中的Ec2计算机读取流量? [英] How to restrict access to ALB so that it reads traffic only from a Ec2 machine in AWS?
问题描述
我在非默认VPC中具有以下架构.
I have a below architecture within a non default VPC.
Route53 -> ALB(web server) - > Ec2 (web servers) - > ALB(application server) - > Ec2 (application server) - > RDS.
我希望我的ALB for App服务器仅读取来自Ec2 Web服务器的流量.我尝试在ALB的安全性中添加一条规则，将source作为Ec2 Web服务器的安全组.
I want my ALB for App server to only read the traffic coming from Ec2 web servers. I tried adding a rule in the security of ALB with source as a security group of the Ec2 web servers.
由于某种原因，它不起作用.但是，当我将0.0.0.0/0添加为规则的来源时，它就起作用了.
for some reason, it is not working. But when I add 0.0.0.0/0 as the source for the rules it is working.
我觉得我在这里错过了一些东西.有人可以帮我吗?
I feel I am missing something here. Could anyone help me with this?
推荐答案
由于您的 ALB(应用服务器)是面向Internet 的，因此只能通过进行访问公用IP .这意味着您的 Ec2(网络服务器)正在使用Internet访问 ALB(应用程序服务器):
Since your ALB(application server) is internet facing it can only be accessed through public IP. This means that your Ec2 (web servers) are using Internet to access ALB(application server):
Route53 -> ALB(web server) - > Ec2 (web servers) - > INTERNET -> ALB(application server) - > Ec2 (application server) - > RDS
在这种情况下，您的安全组(SG)只能使用 0.0.0.0/0 规则，而不能通过引用Web服务器的SG来使用.仅当流量在VPC内而不是来自Internet时，SG引用才有效.
In this case, your security groups (SGs) can only work with 0.0.0.0/0 rule, not by referencing web servers' SGs. SG referencing works only if traffic is within VPCs , not from the Internet.
在您的设置中，您的 ALB(应用程序服务器)应该是私有子网中的内部ALB，而不是公共子网.由于您的设置遵循三层体系结构，因此请在下面查看一些示例设计.请注意，在所有这些服务器中，第二个ALB位于内部，而应用程序服务器位于专用子网中.这样就可以按照您想要的方式使用SG.
In your setup, your ALB(application server) should be internal ALB in private subnets, not public ones. Since your setup follows a three-tier architectures, please have a look at some example designs below. Note that in all of them, the second ALB is internal and app servers are in private subnets. This allows to use SGs the way you want.
这篇关于如何限制对ALB的访问，以使其仅从AWS中的Ec2计算机读取流量?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
