I have a service running inside a VPC that is exposed through nginx (also on a server within the VPC), since there are http(s) configurations needed which nginx handles. I want to allow that service to be reached only by servers in the same VPC - right now that's done through hardcoding ips with:
allow <elastic ip>;
allow <specific ip>;
allow <specific ip>;
...
deny all;
The Elastic IP (which is at vpc scope) seems to allow only instances which don't have their own public ip. I've also tried allowing the vpc and subnet CIDR blocks, which I'm assuming don't help since they are internal.
How can I get a general public CIDR for a private VPC? Is it possible? Am I going about this the wrong way?
It sounds like you should use a Security Group.
A security group is like a firewall around every individual Amazon EC2 instance. It controls what ports are accessible from what CIDR range.
Let's say you have an EC2 instance running a service on port 80, and you only want it accessible to other instances in the VPC. You would simply configure the security group to only allow Inbound connections on port 80 from the CIDR range of the VPC. This would use the private IP addresses, since that's where the traffic is coming from.
Let's go one step better... let's say you only want specific instances to be able to communicate. You would:
App-SG)Web-SG)Web-SG to allow Inbound connections on port 80 from App-SGThat is, the security group specifically references another security group. This will allow inbound connections from any EC2 instance that has the App-SG associated with it.
None of the above requires an Elastic IP address. Only public-facing resource require a public IP address. It is quite common to only expose a Load Balancer and to keep everything else 'private'.