Can’t ping ec2 instance from another ec2 instance in another account

To communicate outside of the VPC, each non-default subnet needs a routing table and an internet gateway associated to it (the default subnets get an external gateway and a routing table by default).

Depending on the way you have created public subnet in the VPC, you might need to explicitly add them additionally. Your VPC setup sounds like it matches Scenario 1 - a private cloud (VPC) with a single public subnet, and an Internet gateway to enable communication over the Internet from the AWS VPC documentation.

You will need to add an internet gateway to your VPC and inside the Public subnet's routing table assign 0.0.0.0/0 (default route) to go to the assigned internet gateway. There is a nice illustration of the exact network topology inside the documentation.

Also, for more information, you can check the VPC Internet Gateway AWS documentation. Unfortunately it's a little messy and a non-obvious gotcha.

For more details about connection issues, see also: Troubleshooting Connecting to Your Instance.

I resolved this with help from AWS tech support. Here's the info for future newbie's like me:

The issue was that iptables was running on instance B and not allowing any traffic. I learned that there are two levels of firewall for EC2 instances: security groups (managed at the AWS console) and iptables (managed on the host). There are reasons to use iptables, for example https://wincent.com/wiki/Using_iptables_on_EC2_instances

Most of the time you don't need to worry about using a host-level firewall such as iptables when running Amazon EC2, because Amazon allows you to run instances inside a "security group", which is effectively a firewall policy that you use to specify which connections from the outside world should be allowed to reach the instance. However, this is a "whitelist" approach, and it is not straightforward to use it for "blacklisting" purposes on a running instance.

In my case I don't need host level firewall so turned iptables off:

sudo service chkconfig stop
sudo chkconfig iptables off

Here are some results I got related to the comments posted on this question:

• connecting with private ip worked
• connecting with private DNS name worked
• connecting with public ip worked
• connecting with public EIP worked
• connecting with public DNS worked, but as Chad Smith said in his answer DNS returns the private IP for this name

The reason this worked for me on a different instance is that the image I used in that instance didn't run iptables -- every image is different. The image I used in this case used iptables to disallow all connections except SSH.