All geek questions in one place

Amazon Web Services EC2 for RDS Connectivity with VPC

I am trying to set up an AWS Free Tier account using an EC2 instance and an RDS database with MySQL. Unfortunately, I cannot figure out how to grant access to the database from an EC2 instance. I read all the AWS documentation, but unfortunately it's out of date, since all the questions are posted on StackOverflow. All documentation indicates that I should go to the "Security Groups" section of the RDS control panel. However, when I do this, this is what I came across.

enter image description here

** I would include an image, but I have no reputation.

Well, I understand that I do not use the EC2-Classic platform and that I have to make these changes to the security group in the EC2 control panel, but how ?! I do not want public access to port 3306, I want the EC2 instance to be able to communicate with the RDS database on the private subnet. Any help would be greatly appreciated.

Links to "AWS Documentation on Supported Platforms" and "Using RDS in VPC" do not help. They are outdated and also continue to refer to security groups under the RDS panel, which then only shows me this message.

+6
source share
1 answer

Rule of thumb:. When you configure resources in a VPC, use ONLY the VPC security groups . Individual RDS, Redshift ... etc. security groups work only with ec2-classic. Meaning when you do not configure things in VPC.

Go to the VPC console, and then find the security groups in the left hand menu. These are security groups that should control access to your AWS resources deployed within the VPC.

I can’t talk in detail about what I don’t know about your VPC configuration and what subnet (public / private) you configure them for.

UPDATE:

Here is a hypothetical scenario

VPC: 10.0.0.0/16 1 public subnet: 10.0.0.0/24 1 Private Subnet: 10.0.1.0/24
  • Suppose you put your EC2 instance in Public Subnet
  • Suppose you hosted your RDS instance on a private subnet
  • And you want the EC2 instance to be available on 80,443 from the world, and the RDS instance should be available only through the EC2 instance.

So these are the security group settings:

for instance EC2 Security Group:

 Inbound: port 80, 443 : from 0.0.0.0/0 Outbound: port 3306 : to 10.0.1.0/24

For the RDS security group:

 Inbound: port 3306: from 10.0.0.0/24

Explanation:

 Inbound: port 80, 443 : from 0.0.0.0/0

This will allow the EC2 instance to be available on ports 80 and 443 from the Internet.

 Outbound: port 3306 : to 10.0.1.0/24

This allows the EC2 instance to send traffic to port 3306 only to the private subnet 10.0.1.0/24

 Inbound: port 3306: from 10.0.0.0/24

This allows the RDS instance to accept traffic on port 3306 from the shared subnet 10.0.0.0/24. The EC2 instance is in the public subnet, so by default RDS will receive traffic from the Ec2 instance to port 3306

NOTE. . Above the configuration, it is assumed that you have accordingly set up routing tables for public / private subnets.

Hope this helps.

+15
source

Source: https://habr.com/ru/post/971928/

More articles:


All Articles