Answers: <p>When you use public IP the traffic exits your VPC and comes back in, at which point it is no longer identified as coming from that security group.
  So you can adjust your ssh connection and use private IP</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-01-05T20:23:19.933Z
Answers: Great! I also had to add the private IP to my ssh known_hosts with the appropriate output from ssh-keyscan.
  
  ssh-keyscan -t [encryption_type] [ec2_private_ip_address]
  
  https://serverfault.com/questions/321167/add-correct-host-key-in-known-hosts-multiple-ssh-host-keys-per-hostname
Answers: bynary
Answers: CC BY-SA 4.0
Answers: 2021-01-05T19:44:05.757Z
Answers: 2021-01-05T19:44:05.757Z
Answers: Evgeny Anikiev
Body: <p>I have setup my own gitlab-runner on AWS following GitLab's walkthrough (<a href="https://docs.gitlab.com/12.10/runner/configuration/runner_autoscale_aws/" rel="nofollow noreferrer">Autoscaling GitLab Runner on AWS EC2</a>).</p>
  <p>One step in my deployment is to SSH into another EC2 instance. The SSH connection fails every time (see below for the one exception).</p>
  <p>I have added an Inbound rule to my security group for the EC2 instance that allows SSH connections from the security group for both the gitlab-runner manager and the gitlab-runner machines. Still SSH connections are refused. Allowing SSH traffic from 0.0.0.0/0, however, causes the SSH connection from the gitlab-runner to the EC2 instance to succeed.</p>
  <p>Why doesn't allowing my gitlab-runner security group in the inbound rules work, and how do I fix this so that I don't have to open my EC2 instance to the world to get SSH access from gitlab-runner?</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-01-05T18:36:56.027Z
Comments: Hi @bynary ! Did you use private IP to connect to your EC2 instance ?
Comments: Evgeny Anikiev
Comments: CC BY-SA 4.0
Comments: 2021-01-05T19:04:21.717Z
Comments: I'm using the public IP. Is the private IP what is used for the security group communication across the VPC?
Comments: bynary
Tags: <amazon-ec2><gitlab><gitlab-ci-runner>
Title: How do I SSH into an EC2 instance from AWS gitlab-runner?
UserDisplayName: bynary
ThreadText: # How do I SSH into an EC2 instance from AWS gitlab-runner?
  
  (Asked by: username_0 on 2021-01-05)
  
  I have setup my own gitlab-runner on AWS following GitLab's walkthrough ([Autoscaling GitLab Runner on AWS EC2](https://docs.gitlab.com/12.10/runner/configuration/runner_autoscale_aws/)).
  
  One step in my deployment is to SSH into another EC2 instance. The SSH connection fails every time (see below for the one exception).
  
  I have added an Inbound rule to my security group for the EC2 instance that allows SSH connections from the security group for both the gitlab-runner manager and the gitlab-runner machines. Still SSH connections are refused. Allowing SSH traffic from 0.0.0.0/0, however, causes the SSH connection from the gitlab-runner to the EC2 instance to succeed.
  
  Why doesn't allowing my gitlab-runner security group in the inbound rules work, and how do I fix this so that I don't have to open my EC2 instance to the world to get SSH access from gitlab-runner?
  
  **Tags:** amazon-ec2, gitlab, gitlab-ci-runner
  
  > **Comments:**
  > **username_1**: Hi @username_0 ! Did you use private IP to connect to your EC2 instance ?  
  > **username_0**: I'm using the public IP. Is the private IP what is used for the security group communication across the VPC?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-01-05. Score: 2 | Accepted answer
  
  When you use public IP the traffic exits your VPC and comes back in, at which point it is no longer identified as coming from that security group.
  So you can adjust your ssh connection and use private IP
  
  > **Comments:**
  > **username_0**: Great! I also had to add the private IP to my ssh known_hosts with the appropriate output from ssh-keyscan.  ssh-keyscan -t [encryption_type] [ec2_private_ip_address]  https://serverfault.com/questions/321167/add-correct-host-key-in-known-hosts-multiple-ssh-host-keys-per-hostname  
  
  ---
  
  