title: How do I use AWS security groups to whitelist only certain EC2 instances?
body: <p>My understanding of AWS Security Groups is that it is essentially a whitelist.</p>
  
  <p>Everything is blocked unless explicitly allowed.</p>
  
  <p>Let's say hypothetically that I have some EC2 instances setup with autoscaling.</p>
  
  <p>In the context of autoscaling, I won't necessarily know what those future IP's will be.</p>
  
  <p>Say I have a set of EC2 instances that are used for databases like mysql or mongodb.</p>
  
  <p>I want to only allow my application servers to be able to access my database servers.</p>
  
  <p>Is there a way to create a tag for an EC2 instance and per the security group, allow any EC2 instance with a certain tag?</p>
  
  <p>How is this usually done in the real world?</p>
  
  <p>Thanks in advance</p>