http://packages.us-west-2.amazonaws.com/2012.09/main/201209eb6a01/x86_64/repodata/repomd.xml: [Errno 12] Timeout on http://packages.us-west-2.amazonaws.com/2012.09/main/201209eb6a01/x86_64/repodata/repomd.xml: (28, 'connect() timed out!') Trying other mirror.
I found that opening up outbound traffic completely for the security group for that server resolved the problem and was able to successfully download packages.
Last night I talked to some Amazon folks at an event recently that told me because the VPC is a stateful firewall it would be OK to open all outbound traffic for that server.
However... If prefer to know that you are getting your updates from a valid Amazon repo or at least an Amazon IP, you can open up your outbound traffic in your security group to the specific IPs or IP ranges for the repo(s) you are trying to connect to.
For instance, if the error message says you are trying to connect to: http://packages.us-west-2.amazonaws.com...
Open a command prompt and ping packages.us-west-2.amazonaws.com
I got IP address: 205.251.235.166
The IP for this repo could change obviously but you could set up your security group to allow outbound traffic to this IP address. If the IP for that repo changes at some point you'll get an error and have to change the IP to whatever Amazon changes the domain to point to in the future.
You can also go to Arin.org and get the complete Amazon IP range for this IP and allow traffic to all Amazon IP adddresses outbound. In this case 205.251.192.0/18
http://whois.arin.net/rest/net/NET-205-251-192-0-1/pft
NetRange 205.251.192.0 - 205.251.255.255
CIDR 205.251.192.0/18
Name AMAZON-05
Handle NET-205-251-192-0-1
Parent NET205 (NET-205-0-0-0-0)
Net Type Direct
Assignment Origin AS AS7224 AS16509 AS39111
Organization Amazon.com, Inc. (AMAZON-4)
Registration Date 2010-08-27
Last Updated 2012-03-02
Comments RESTful Link http://whois.arin.net/rest/net/NET-205-251-192-0-1
When I ping packages.sa-east-1.amazonaws.com I get a Lacnic IP address:
177.72.244.0
You'd have to go to lacnic.org to look up that IP range:
inetnum: 177.72.240/21 aut-num: AS53032 abuse-c: MAAZI67 owner: A100 ROW SERVICOS DE DADOS BRASIL LTDA ownerid: 012.147.176/0001-50 responsible: Marla Azinger country: BR owner-c: MAAZI67 tech-c: MAAZI67 inetrev: 177.72.240/21 nserver: pdns1.ultradns.net nsstat: 20130329 AA nslastaa: 20130329 nserver: pdns2.ultradns.net nsstat: 20130329 AA nslastaa: 20130329 nserver: pdns3.ultradns.org nsstat: 20130329 AA nslastaa: 20130329 nserver: pdns5.ultradns.info nsstat: 20130329 AA nslastaa: 20130329 nserver: pdns6.ultradns.co.uk nsstat: 20130329 AA nslastaa: 20130329 created: 20110816 changed: 20111121 nic-hdl-br: MAAZI67 person: Marla Azinger e-mail: mazinger@amazon.com created: 20111114 changed: 20111118
