Security Groups on AWS RA

Galera replication uses the following port for communication:

• 443 - For TLS connections between the CA and the RA/VA.

In this example, the VPC internal address space is 172.16.0.0/16 in US-East-1, and the address space in US-East-2 is 172.31.0.0/16.

To create a security group that allows for TLS traffic within the VPCs:

1. Create a Security Group called "TLS 443 Traffic to US-East"

2. Add the following Inbound rules:

3. Add the following Outbound rules:

These rules will allow any connections outbound to any address and any inbound connection on port 443 from any address on the 172.16.0.0/16 and 172.31.0.0/16 subnets. The same rule in the other VPC will also need the same rule configured. These rules may be tightened as required for the organization.

4. To apply these Security Groups to the EJBCA Enterprise Cloud Nodes in each of the VPCs, right-click the node, select Networking > Change Security Groups.

5. In the list of Security Groups, check the new Security Group to let the instance communicate with the other nodes in the cluster.