I'm using AWS EC2 (no other AWS services yet), and I have this setup:
Region 1 (N. Virginia): instance A, in VPC YYY, has public IP 123
Region 2 (S. Paulo ): instance B, in VPC ZZZ, has public IP 456
I need to make a TCP request from instance B to instance A.
At first, I thought I would only need to add instance B's public IP (456) to the security group of instance A, but that didn't work (I could't establish a TCP connection as I expected).
I'm guessing that, between regions, another IP different from de public one is used when one instance tries to reach another, but not the private one since the private IP is local to the VPC (right?).
So, how to achieve this? What IP should I whitelist in the security group/firewall of instance A?
Or perhaps, in general, what's the best practice to do this? (connect two instances of different Regions/VPC between them).
Thanks!
Without knowing your VPC configuration, it is very difficult to comment. Most likely your instance B is in a private subnet of your VPC. Assuming you are running Linux, can you ping www.google.com from B? If you can, then curl www.whatsmyip.com will give you the public address of B (search for the IP in curl output). Use that IP to open the security group of A to allow traffic from B.
Now you can have your ec2 instances in different regions communicate over private ip address setting up an inter-region VPC peering.
As noted in the official AWS documentation:
You can establish peering relationships between VPCs across different AWS Regions (also called inter-Region VPC peering). This allows VPC resources including EC2 instances, Amazon RDS databases and Lambda functions that run in different AWS Regions to communicate with each other using private IP addresses, without requiring gateways, VPN connections, or separate network appliances. The traffic remains in the private IP space. All inter-region traffic is encrypted with no single point of failure, or bandwidth bottleneck. Traffic always stays on the global AWS backbone, and never traverses the public internet, which reduces threats, such as common exploits, and DDoS attacks. Inter-Region VPC Peering provides a simple and cost-effective way to share resources between regions or replicate data for geographic redundancy.