Installing Gremlin on AWS - Configuring your VPC

Amazon Web Services (AWS) has unique networking requirements that must be implemented for Gremlin to run successfully. This article explains how to configure rules for your AWS Virtual Private Cloud (VPC) security groups and network Access Control Lists (ACLs) to allow outbound and inbound network access to the Gremlin API.

‍

There are two steps to configure a VPC to allow Gremlin traffic: creating prefix lists, and creating network ACL rules.

Prerequisites

This page assumes that you:

• Have an existing AWS Lambda or EC2 instance that you want to use with Gremlin.
• Already created and attached a VPC to the instance.

Step 1: Creating security groups and prefix lists

You'll first need to create a prefix list containing the IP addresses for the Gremlin API, then create a security rule containing the prefix list.

Creating a customer-managed prefix list

Create a customer-managed prefix list. This list will contain the CIDR addresses necessary for identifying Gremlin traffic.

‍

Creating a security group

Create a Security Group using the Gremlin API prefix created in the previous section.

1. Open the VPC console at https://console.aws.amazon.com/vpc/.
2. Select Security groups in the navigation pane, then select Create security group.
3. For the Name and Description, enter a name such as "Gremlin API".
4. From VPC, choose the VPC you want to attach the group to.
5. Add the rule (detailed instructions are available at this link):
6. ^Under Outbound rules, change All traffic to HTTPS.
7. ^Using the search box next to Destination, select the managed prefix list you created in the previous section.
8. ^Optionally, enter a description for this security group (e.g. "Allow outbound HTTPS access to the Gremlin API.")
9. ^Optionally, add any Tags for this security group.
10. Click Create security group.
11. Assign the security group to your EC2 instance by selecting the security group during the instance launch wizard, or by defining the scurity group in a launch template.

To verify that the Gremlin agent can connect to the Gremlin API, open the hosts page in the Gremlin web app and verify that your instance is listed with an Active status.

Step 2: Creating network Access Control Lists (ACLs)

‍

After creating and assigning security groups, the next step is to create network Access Control List (ACL) rules. There are a few key differences between network ACLs and security groups:

• Network ACLs are attached at the subnet level, not the VPC level. You'll need to identify the specific subnet(s) that your EC2 or Lambda instance is assigned to.
• ACLs use individual IP addresses, so you'll need to add each Gremlin API address to the ACL.
• ACLs are stateless—they don't associate inbound network responses with outbound requests. You'll need to open inbound ports as well as outbound ports.

Creating a network ACL

To create a network ACL for the Gremlin API:

1. Open the VPC console at https://console.aws.amazon.com/vpc/.
2. Select Network ACLs in the navigation pane.
3. Select Create Network ACL.
4. Enter a name for the ACL and select the VPC you want to attach it to.
5. Optionally, add any tags you want to use to help identify the ACL.

Adding inbound rules to a network ACL

Next, we'll need to add an inbound rule to the ACL. This allows our instance to receive response traffic from the Gremlin API:

‍

Adding outbound rules to a network ACL

Now that we have our inbound rules configured, let's create outbound rules so that our instance can send traffic to the Gremlin API:

‍

Associating the network ACL with a subnet

The final step is to associate the ACL with one or more subnets.

1. On the Network ACLs page, click on the ACL you want to edit.
2. Click Subnet associations, then click Edit subnet associations.
3. Check or uncheck the subnet(s) you want this ACL to apply to, then click Save changes.