title: Why does MongoDB port 27017 need to be opened in AWS EC2 Security Group?
body: <p>(I've searched SO, AWS support and more widely without success.)</p>
  
  <p>I've just successfully deployed a MEANjs application to a Bitnami MEAN instance on EC2, following <a href="https://scotch.io/tutorials/deploying-a-mean-app-to-amazon-ec2-part-1" rel="nofollow noreferrer">Ahmed Haque's excellent tutorial on scotch.io</a>.  As part of the tutorial/deployment I altered the AWS Security Group to include port 27017 for MongoDB traffic.  The CIDR notation for the port 27017 was 0.0.0.0/0 - which AFAIK means 'allow access from any IP address'.</p>
  
  <blockquote>
    <p>Question: Why does MongoDB port 27017 need to be opened in AWS EC2
    Security Group for a 'production' type environment?  Surely this is directly exposing the DB to the
    Internet. The only thing that should be talking to Mongo is the
    "/server/api" code, which is running on the same instance - 
    and so shouldn't need the port opening.</p>
    
    <p>If I change the Security Group rule for port 27017 by closing off 27017, changing the source to: localhost, the internal IP address, the public IP address, or hack a CIDR to be equivalent to any of those - then the web app hangs (static content returns but no responses to db backed api calls). Changing the SG rule back to 0.0.0.0/0 almost immediately 'fixes' the hang.</p>
  </blockquote>
  
  <p>All is otherwise sweet with my install.  I've closed port 3000 (the node app) in the Security Group and am using Apache to proxy port 80 traffic to port 3000.  Set up like this, port 3000 does not need to be open in the Security Group; to me this implies that on-instance traffic doesn't need ports to be externally exposed - so how come that's not true of the Mongo port?</p>
  
  <p>I cant see anything in the '/client' code which is talking direct to Mongo.</p>
  
  <p>What am I missing?</p>
  
  <p>Thanks in advance - John</p>