Create a security group

The Vertica AMI has specific security group requirements.

The Vertica AMI has specific security group requirements. When you create a Virtual Private Cloud (VPC), AWS automatically creates a default security group and assigns it to the VPC. You can use the default security group, or you can name and assign your own.

Create and name your own security group using the following basic security group settings. You may make additional modifications based on your specific needs.

Inbound

Type	Use	Protocol	Port Range	IP
SSH		TCP	22	The CIDR address range of administrative systems that require SSH access to the Vertica nodes. Make this range as restrictive as possible. You can add multiple rules for separate network ranges, if necessary.
DNS (UDP)		UDP	53	Your private subnet address range (for example, 10.0.0.0/24).
Custom UDP	Spread	UDP	4803 and 4804	Your private subnet address range (for example, 10.0.0.0/24).
Custom TCP	Spread	TCP	4803	Your private subnet address range (for example, 10.0.0.0/24).
Custom TCP	VSQL/SQL	TCP	5433	The CIDR address range of client systems that require access to the Vertica nodes. This range should be as restrictive as possible. You can add multiple rules for separate network ranges, if necessary.
Custom TCP	Inter-node Communication	TCP	5434	Your private subnet address range (for example, 10.0.0.0/24).
Custom TCP		TCP	5444	Your private subnet address range (for example, 10.0.0.0/24).
Custom TCP	MC	TCP	5450	The CIDR address of client systems that require access to the management console. This range should be as restrictive as possible. You can add multiple rules for separate network ranges, if necessary.
Custom TCP	Rsync	TCP	50000	Your private subnet address range (for example, 10.0.0.0/24).
ICMP	Installer	Echo Reply	N/A	Your private subnet address range (for example, 10.0.0.0/24).
ICMP	Installer	Traceroute	N/A	Your private subnet address range (for example, 10.0.0.0/24).

Note

In Management Console (MC), the Java IANA discovery process uses port 7 once to detect if an IP address is reachable before the database import operation. Vertica tries port 7 first. If port 7 is blocked, Vertica switches to port 22.

Outbound

Type	Protocol	Port Range	Destination	IP
All TCP	TCP	0-65535	Anywhere	0.0.0.0/0
All ICMP	ICMP	0-65535	Anywhere	0.0.0.0/0
All UDP	UDP	0-65535	Anywhere	0.0.0.0/0

For information about what a security group is, as well as how to create one, see Amazon EC2 Security Groups for Linux Instances in the AWS documentation.