I have setup my own gitlab-runner on AWS following GitLab's walkthrough (Autoscaling GitLab Runner on AWS EC2).

One step in my deployment is to SSH into another EC2 instance. The SSH connection fails every time (see below for the one exception).

I have added an Inbound rule to my security group for the EC2 instance that allows SSH connections from the security group for both the gitlab-runner manager and the gitlab-runner machines. Still SSH connections are refused. Allowing SSH traffic from, however, causes the SSH connection from the gitlab-runner to the EC2 instance to succeed.

Why doesn't allowing my gitlab-runner security group in the inbound rules work, and how do I fix this so that I don't have to open my EC2 instance to the world to get SSH access from gitlab-runner?

  • Hi @bynary ! Did you use private IP to connect to your EC2 instance ? – Evgeny Anikiev Jan 5 at 18:36
  • I'm using the public IP. Is the private IP what is used for the security group communication across the VPC? – bynary Jan 5 at 19:04

When you use public IP the traffic exits your VPC and comes back in, at which point it is no longer identified as coming from that security group. So you can adjust your ssh connection and use private IP

  • Great! I also had to add the private IP to my ssh known_hosts with the appropriate output from ssh-keyscan. ssh-keyscan -t [encryption_type] [ec2_private_ip_address] serverfault.com/questions/321167/… – bynary Jan 5 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.