SFTP to Amazon EC2 Instances in an Auto Scaling Group, through a Network Load Balancer

Say you have a bunch of EC2 instances in an auto scaling group & you have a requirement to be able to connect to them via SFTP. Maybe they’re web servers sharing an EFS & you wanna get to that mounted EFS via SFTP. Or maybe you wanna download tons of application logs by SFTP-ing to the instances directly.

The problem here is that since the instances are in an auto scaling group, they could die & recreate any time & when they do, they change their IPs. Not to mention that they’re most likely not publicly accessible & you’ll need a bastion host to SFTP to them anyway.

Wouldn’t it be great if you could target your SFTP connection to a load balancer in front of the auto scaling group, instead of individual instances in the group itself. The LB won’t change its DNS name, unlike the private IP of the EC2s behind it. And you also don’t need to pay for a bastion host!

This can be achieved simply by creating a listener in the network load balancer as shown below. Application load balancer cannot be used here because it only supports HTTP(S) listeners.

Next, ensure that stickiness is enabled in the target group’s settings:

Now you can use any SFTP client like FileZilla to connect to the NLB’s DNS name & that’ll get you an SFTP session with 1 of the web servers:

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.