I wasn't sure if this is the right sub-StackExchange for this question so feel free to boot me somewhere else if need be.
I am trying to work with two EC2 servers: one is a "workstation" and the other a "node" (think Chef). The security group of the workstation started out with just one incoming rule that allowed access to port 22 from my local machine's IP address.
I wanted the node server to be accessible from the workstation server, but also from my local machine. So rather than create a new security group, I just added a rule to the security group used on the workstation with its own security group id as the source. In plain English, what I was going for is a security group that allows access on port 22 either from my local machine's IP address or any machine that also has the security group applied. This was my understanding of how the default security group works (all traffic allowed, with the source being the self-referential security group id).
To my mind this was also in line with what I found here in the docs:
If there is more than one rule for a specific port, we apply the most permissive rule. For example, if you have a rule that allows access to TCP port 22 (SSH) from IP address 203.0.113.1 and another rule that allows access to TCP port 22 from everyone, everyone has access to TCP port 22.
My case is obviously a bit different in that I have a rule that allows specific access to port 22 from a specific IP address and a rule that allows specific access to port 22 from a security group rather than from "everyone," but wouldn't a security group source also be considered more permissive than a specific IP address and therefore allow the scenario I described above?
Unfortunately, with the security group set up this way I am only able to SSH into the node from my local machine. When I try to SSH from the workstation on EC2 (that shares the same security group), it times out.
Any ideas on what I might be doing wrong/missing?