1

I have setup my own gitlab-runner on AWS following GitLab's walkthrough (Autoscaling GitLab Runner on AWS EC2).

One step in my deployment is to SSH into another EC2 instance. The SSH connection fails every time (see below for the one exception).

I have added an Inbound rule to my security group for the EC2 instance that allows SSH connections from the security group for both the gitlab-runner manager and the gitlab-runner machines. Still SSH connections are refused. Allowing SSH traffic from 0.0.0.0/0, however, causes the SSH connection from the gitlab-runner to the EC2 instance to succeed.

Why doesn't allowing my gitlab-runner security group in the inbound rules work, and how do I fix this so that I don't have to open my EC2 instance to the world to get SSH access from gitlab-runner?

Improve this question
2
  • Hi @bynary ! Did you use private IP to connect to your EC2 instance ?
    – Evgeny Anikiev
    Commented Jan 5, 2021 at 18:36
  • I'm using the public IP. Is the private IP what is used for the security group communication across the VPC?
    – bynary
    Commented Jan 5, 2021 at 19:04

1 Answer 1

Reset to default
2

When you use public IP the traffic exits your VPC and comes back in, at which point it is no longer identified as coming from that security group. So you can adjust your ssh connection and use private IP

Improve this answer
1
  • Great! I also had to add the private IP to my ssh known_hosts with the appropriate output from ssh-keyscan. ssh-keyscan -t [encryption_type] [ec2_private_ip_address] serverfault.com/questions/321167/…
    – bynary
    Commented Jan 5, 2021 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.