Skip to main content

Open Amazon Elastic Compute Cloud security group for ArcGIS

Amazon provides security groups that allow you to specify who can connect to Amazon Elastic Compute Cloud (EC2) instances.

If you use the Amazon Web Services (AWS) Management Console to deploy ArcGIS Enterprise or a stand-alone ArcGIS Server site, you must create a security group and add a Remote Desktop or SSH rule if you need to connect to the instances directly. Additionally, you must add HTTP and HTTPS access rules for users to access your web services and portal. Finally, you need to allow all instances in your security group to access each other.

These processes are summarized in the following steps:

  1. Sign in to your AWS account in the AWS Management Console and edit the inbound rules for your security group.

  2. To connect directly to an Amazon instance, do one of the following:

    • If you use Windows instances and want to make Remote Desktop Connections, add a rule allowing access to port 3389 from an approved IP address or range of IPs.

    • If you use Linux instances and want to make SSH connections, add a rule allowing access to port 22 from an approved IP address or range of IPs.

    Note:

    If you built your site using an ArcGIS Enterprise tool for Amazon Web Services, you do not need to complete the next step, as the tool or template added these rules for you.

  3. If you built your site using the AWS Management Console, you need to add these rules:

    • If your instance includes a portal, add a rule allowing connections through port 7443. Specify a range of IP addresses that are allowed to connect to the site through this port.

    • If you have a stand-alone or federated ArcGIS Server site on the instance and you'll be using encrypted connections to it, add a rule allowing connections through port 6443. Specify a range of IP addresses that are allowed to connect to the site through this port.

    • If you have a stand-alone or federated ArcGIS Server site on the instance, and you'll be using HTTP connections, add a rule allowing connections through port 6080. Specify a range of IP addresses that are allowed to connect to the site through this port.

    • Add a rule to allow all instance in your security group full access to each other.

  4. Save the changes you make to your security group rules.

See Common security group configurations to learn more about these security rules and when to adjust them.