Security – AWS, NodeJS – Connecting app to Mongodb on another EC2 instance

amazon ec2amazon-web-servicesmongodbSecurity

I am trying to connect my app, running on one EC2 instance, to MongoDB, running on another EC2 instance. I'm pretty sure the problem is in the security settings, but I'm not quite sure how to handle that.

First off, my app's instance is in an autoscaling group that sits behind an ELB. The inbound security settings for the instance and ELB allow access to port 80 from anywhere, as well as all traffic from its own security group.

The EC2 instance that runs Mongo is able to take connections if the security group for that instance accepts all inbound traffic from anywhere. Any other configuration that I've tried causes the app to say that it cannot make a connection with the remote address. I've set rules to accept inbound traffic from all security groups that I have, but it only seems to work when I allow all traffic from anywhere.

Also, my db instance is set up with an elastic ip. Should I have this instance behind an ELB as well?

So my questions are these:

1) How can I securely make connections to my EC2 instance running mongo?

2) In terms of architecture, does it make sense to run my database this way, or should I have this behind a load balancer as well?

This issue is tripping me up a lot more than I thought it would, so any help would be appreciated.

NOTE

I have also set the bind_ip=0.0.0.0 in /etc/mongo.conf

Best Answer

Your issue is that you are using the public elastic IP to connect to your database server from your other servers. This means that the connection is going out to the internet and back into your VPC, which presents the following issues:

  1. Security issues due to the data transmission not being contained within your VPC
  2. Network latency issues
  3. Your database server's security group can't identify the security group of the inbound connections

Get rid of the elastic IP on the MongoDB server, there is no need for it unless you plan to connect to it from outside your VPC. Modify your servers to use the private internal IP address assigned to your database server when creating connections to it. Finally, lock your security group back down to only allow access to the DB from your other security group(s).

Optional: Create a private hosted zone in Route53, with an A record pointing to your database server's private IP address, then use that hostname instead of the internal IP address.

Related Topic