I have an AWS setup where I use an Infrastructure as Code (IAC) template (YAML) to deploy a stack using CloudFormation. My deployment creates two AWS EC2 instances: Main-service and Data-service.

Both EC2 instances run a Docker container within the instance. Main-service instance has a public IP and runs a Java application in the container which runs on port 8000. Data-service instance has only a private IP and runs an ArangoDB server on port 8529 in the container which is running on port 8002. My aim is to connect to the ArangoDB running inside the Docker container on Data-service from the Java application running on Main-service. Below is my Java code:

public static ArangoDB getArangoDB(AQLServerConnection aqlServerConnection) throws Exception {
    String address = aqlServerConnection.getHost() + ":" + aqlServerConnection.getPort();
    //port used for connection: 8529
    try {
        ArangoDB arangoDB = new ArangoDB.Builder()
            .host(aqlServerConnection.getHost(), aqlServerConnection.getPort())
            .user(aqlServerConnection.getUsername())
            .password(aqlServerConnection.getPassword())
            .build();
        return arangoDB;
    } catch (Exception e) {
        throw e;
    }
}

If I do not map port 8529 in Docker run command of Main-service container. I only map port 8529 in the Docker run command of the Data-service container and added inbound rules in the security group of Data-service. Below is my script:

Data-service.yaml

docker run -d --restart always --network host -p 8000:8000 -p 8002:8002 -p 8529:8529 
-v /var/run/docker.sock:/var/run/docker.sock --log-driver=awslogs 
-e IB_SERVICE_DEPLOYMENT_TYPE=AWS_EC2 -e IS_PRIVATE_SUBNET=true 
${Repository}/dataservice-${Architecture}:latest

Security_Group.yaml:

Resources:
  MainServiceSecurityGroup: 
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: MainServiceSecurityGroup
      VpcId: !Ref VPC
      GroupDescription: Allows access from anywhere to the Main Service
      SecurityGroupIngress:
        - IpProtocol: tcp
          ToPort: 8000
          FromPort: 8000
          CidrIp: 0.0.0.0/0
      Tags: 
        - {Key: Name, Value: !Sub 'MainServiceSecurityGroup-${StackName}'}
  DataServiceSecurityGroup: 
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: DataServiceSecurityGroup
      VpcId: !Ref VPC
      GroupDescription: Allows only the Main-Service to access the services
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8002
          ToPort: 8002
          SourceSecurityGroupId: !Ref IBMainServiceSecurityGroup
        - IpProtocol: tcp
          FromPort: 8529
          ToPort: 8529
          SourceSecurityGroupId: !Ref MainServiceSecurityGroup

However, with this configuration, the connection to ArangoDB from Main-service fails with the following exception:

com.arangodb.ArangoDBException: Cannot contact any host!
    at com.arangodb.internal.net.FallbackHostHandler.get(FallbackHostHandler.java:57) ~[core-7.1.0.jar:7.1.0]
    at com.arangodb.internal.net.DirtyReadHostHandler.get(DirtyReadHostHandler.java:52) ~[core-7.1.0.jar:7.1.0]
    at com.arangodb.http.HttpCommunication.execute(HttpCommunication.java:101) ~[http-protocol-7.1.0.jar:7.1.0]
    at com.arangodb.http.HttpCommunication.execute(HttpCommunication.java:66) ~[http-protocol-7.1.0.jar:7.1.0]
    at com.arangodb.http.HttpProtocol.execute(HttpProtocol.java:44) ~[http-protocol-7.1.0.jar:7.1.0]
    at com.arangodb.internal.ArangoExecutorSync.execute(ArangoExecutorSync.java:60) ~[core-7.1.0.jar:7.1.0]
    at com.arangodb.internal.ArangoExecutorSync.execute(ArangoExecutorSync.java:52) ~[core-7.1.0.jar:7.1.0]

If I map port 8529 in the Docker run command and the security group of Main-service, then the connection to ArangoDB is successful.

Main-service.yaml

docker run --stop-timeout 45 -d --restart always --network host -p 8000:8000 -p 8529:8529 
${Repository}/mainserver-${Architecture}:latest

Security_Group.yaml:

Resources:
  MainServiceSecurityGroup: 
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: MainServiceSecurityGroup
      VpcId: !Ref VPC
      GroupDescription: Allows access from anywhere to the Main Service
      SecurityGroupIngress:
        - IpProtocol: tcp
          ToPort: 8000
          FromPort: 8000
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 8529
          ToPort: 8529
          CidrIp: 0.0.0.0/0
      Tags: 
        - {Key: Name, Value: !Sub 'MainServiceSecurityGroup-${StackName}'}
  DataServiceSecurityGroup: 
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: DataServiceSecurityGroup
      VpcId: !Ref VPC
      GroupDescription: Allows only the Main-Service to access the services
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8002
          ToPort: 8002
          SourceSecurityGroupId: !Ref IBMainServiceSecurityGroup
        - IpProtocol: tcp
          FromPort: 8529
          ToPort: 8529
          SourceSecurityGroupId: !Ref MainServiceSecurityGroup

As per my findings, mapping a port on the instance that has a public IP involves security risks.

• Is my approach incorrect?
• Can I avoid mapping 8529 port at Main-service instance level?
• Is there a workaround?