title: Limit SSH access by AWS security group
body: <p>I have two EC2 instances, both in the same public subnet and both in the same availability zone.</p>
  
  <p>I want one of the instances to be able to access the other via SSH.</p>
  
  <p>Here are the security groups I have configured so far:</p>
  
  <p><strong>Instance #1: Web Server</strong></p>
  
  <ul>
  <li>allow_http <code>inbound and outbound port 80 0.0.0.0/0</code></li>
  <li>allow_https <code>inbound and outbound port 443 0.0.0.0/0</code></li>
  <li>allow_internal_ssh <code>inbound and outbound port 22 allow_internal_ssh (self)</code></li>
  </ul>
  
  <p><strong>Instance #2: SSH Only</strong></p>
  
  <ul>
  <li>allow_ssh <code>inbound and outbound port 22 0.0.0.0/0  # soon to be my home IP</code></li>
  <li>allow_internal_ssh <code>inbound and outbound port 22 allow_internal_ssh (self)</code></li>
  </ul>
  
  <p>I want <strong>#1</strong> to only be accessible by SSH from <strong>#2</strong>.</p>
  
  <p>I thought I could do that by assigning the same security group (<code>allow_internal_ssh</code>) to both, however, it's not working!</p>
  
  <p>With the setup described above, I cannot connect to <strong>#2</strong>.</p>
  
  <p>If I give both instances the <code>allow_ssh</code> security group I can access the SSH server <strong>(#2)</strong> and then from there login to the web server <strong>(#1)</strong>.</p>
  
  <p>Any advice on debugging this or help to setup SSH access from the same security group would be very much appreciated!</p>