在AWS ec2实例之间连接到mongodb时如何配置安全组？

Question

I have one ec2 instance with mongodb (called ec2-mongo) with the security group, sg-mongodb-server. And I am trying to connect to mongodb via another ec2 instance (called ec2-connect) with the security group, sg-connect. I want to set the rules to allow for traffic between the two security groups without referring to specific IP Addresses. How can I do this?

I can connect to mongo when my security groups are set up as follows (so there is nothing wrong with the servers as far as I know). Outbound is set to all:

sg-mongodb-server :

Inbound:
Port    Source
22      my_ip
27017   ip_of_ec2-connect

sg-connect :

Inbound:
Port    Source
22      my_ip
27017   ip_of_ec2-mongo

but when I try to use security groups instead of IP Addresses I can't connect to mongodb.

sg-mongodb-server :

Inbound:
Port    Source
22      my_ip
27017   sg-connect

sg-connect :

Inbound:
Port    Source
22      my_ip
27017   sg-mongodb-server

Error message when trying to connect:

MongoDB shell version: 3.2.3
connecting to: XXX.XXX.XXX.XXX/test
2016-02-19T18:24:09.245+0000 W NETWORK  [thread1] Failed to connect to XXX.XXX.XXX.XXX:27017 after 5000 milliseconds, giving up.
2016-02-19T18:24:09.245+0000 E QUERY    [thread1] Error: couldn't connect to server XXX.XXX.XXX.XXX:27017, connection attempt failed :
connect@src/mongo/shell/mongo.js:226:14
@(connect):1:6

exception: connect failed

Answer 1

In order for security group references to work, you need to connect to your MongoDB from the EC2 instance by the MongoDB server's private IP address, not it's public IP address.

If you are using the public IP address (or the DNS name is resolving to the public IP address), then the connection will leave your VPC and re-enter, thus appearing to originate from the outside world.

By using the private IP address, then it can tell that it's coming from your security group.