# Chef server to manage EC2 instances

**URL:** <https://discourse.chef.io/t/chef-server-to-manage-ec2-instances/3519>\
**Category:** Chef Infra (archive)\
**Created:** [January 23, 2013, 2:56pm UTC](https://discourse.chef.io/t/chef-server-to-manage-ec2-instances/3519 "2013-01-23T14:56:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sam\_Darwin1](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@Sam\_Darwin1](https://discourse.chef.io/u/Sam_Darwin1)\
**Post date:** [January 23, 2013, 2:56pm UTC](https://discourse.chef.io/t/chef-server-to-manage-ec2-instances/3519/1 "2013-01-23T14:56:08Z")

</div>

Hi,

I have setup a chef server on EC2, to manage EC2 instances. I have assigned  
the DNS entry for [chef.example.com](http://chef.example.com) to the public IP, so the web gui is  
reachable from anywhere on the internet. When it comes to bootstrapping  
clients, I can create an entry in /etc/hosts , which points [chef.example.com](http://chef.example.com) to  
the private IP, which seems more secure , or I can open port 4000 in the  
firewall, and use the public IP address. Each has pros and cons.

The problem with adding the private IP into the hosts file, is that it’s  
pre-bootstrap manual labor every time, and in the event of an IP change, it  
will be a lot of fixing.

The problem with using the public IP, is that port 4000 is open to the world.  
Is that dangerous?

Any general comments or suggestions?

Thanks.

---

<div class="post-metadata">

**Author:** ![Vladimir\_Girnet](https://avatars.discourse-cdn.com/v4/letter/v/e19b73/32.png) [@Vladimir\_Girnet](https://discourse.chef.io/u/Vladimir_Girnet)\
**Post date:** [January 23, 2013, 3:05pm UTC](https://discourse.chef.io/t/chef-server-to-manage-ec2-instances/3519/2 "2013-01-23T15:05:49Z")

</div>

You can set an additional protection layer by using httpd in fron of Chef Server  
[http://wiki.opscode.com/display/chef/How+to+Proxy+Chef+Server+with+Apache](http://wiki.opscode.com/display/chef/How+to+Proxy+Chef+Server+with+Apache)

On Jan 23, 2013, at 4:56 PM, [samuel.d.darwin@gmail.com](mailto:samuel.d.darwin@gmail.com) [samuel.d.darwin@gmail.com](mailto:samuel.d.darwin@gmail.com) wrote:

> Hi,
> 
> I have setup a chef server on EC2, to manage EC2 instances. I have assigned  
> the DNS entry for [chef.example.com](http://chef.example.com) to the public IP, so the web gui is  
> reachable from anywhere on the internet. When it comes to bootstrapping  
> clients, I can create an entry in /etc/hosts , which points [chef.example.com](http://chef.example.com) to  
> the private IP, which seems more secure , or I can open port 4000 in the  
> firewall, and use the public IP address. Each has pros and cons.
> 
> The problem with adding the private IP into the hosts file, is that it's  
> pre-bootstrap manual labor every time, and in the event of an IP change, it  
> will be a lot of fixing.
> 
> The problem with using the public IP, is that port 4000 is open to the world.  
> Is that dangerous?
> 
> Any general comments or suggestions?
> 
> Thanks.

--  
Vladimir Girnet  
Senior Infrastructure Engineer  
Tacit Knowledge

> **[Tacit Knowledge joins forces with Grid Dynamics - Tacit Knowledge](http://www.tacitknowledge.com)**
>
> In May 2021, we joined forces with Grid Dynamics, a digital-native technology services provider that accelerates growth for Forture 1000 companies.

---

<div class="post-metadata">

**Author:** ![Bryan\_Horstmann\_Alle](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bryan_horstmann_alle/32/614_2.png) [@Bryan\_Horstmann\_Alle](https://discourse.chef.io/u/Bryan_Horstmann_Alle)\
**Post date:** [January 23, 2013, 3:07pm UTC](https://discourse.chef.io/t/chef-server-to-manage-ec2-instances/3519/3 "2013-01-23T15:07:31Z")

</div>

±-----------------------------------------------------------------------------  
| On 2013-01-23 06:56:08, [samuel.d.darwin@gmail.com](mailto:samuel.d.darwin@gmail.com) wrote:  
|  
| Any general comments or suggestions?

Set the record for “[chef.example.com](http://chef.example.com)” to CNAME for the public EC2 DNS for that  
instance. EC2 does split horizon so within EC2, the public name will resolve to  
the private IP.

## You probably don’t want to open :4000 to the world, no.

bdha  
cyberpunk is dead. long live cyberpunk.