I recently inherited an AWS account's maintenance and noticed that the db access is wide open to any network, anywhere! So I decided it must be simple like it is when we do it with our own VMs. Except on Amazon AWS EC2 instances have an internal IP and a public IP and sometimes an elastic IP. So I thought ok I'll search google and find a simple quick writeup, and there doesn't seem to be one. So can someone please provide a simple writeup, here, on how to do this. I understand there are three methods on the RDS security and so forth. If you don't have time or desire to cover all three please just pick the one you like and have used for the example. If I don't get a good response on this within a day or so I'll hit the docs and piece it together myself, thank you in advance!
Well I tinkered with it a bit. The docs are not too suggestive. I found on an EC2 instance that has an Elastic IP assigned I had to use the Private IP allowed in the security group I applied to the RDS MySQL database. The Elastic IP assigned or UN-assigned did not affect connection. On the EC2 instance which had no Elastic IP assigned I had to use the Public IP allowed in the security group. The Private IP did not matter. This seems a bit strange to me.
An Amazon Relational Database Service (RDS) instance should typically be kept private to prevent access from the Internet. Only in rare circumstances should an RDS instance be accessible on the Internet.
An RDS instance can be secured in several ways:
1. Launch it in a Private Subnet A Virtual Private Cloud (VPC) can be configured with public and private subnets. Launching the RDS instance in the private subnet will prevent access from the Internet. If access is still required across the Internet (eg to your corporate network), create a secure VPN connection between the VPC and your corporate network.
2. Use Security Groups Security Groups operate like a firewall around each individual EC2 instance. They define which ports and IP address ranges are permitted for inbound and outbound access. By default, outbound access is permitted but inbound access is NOT permitted.
3. No Public IP address If an RDS instance does NOT have a Public IP address, it cannot be directly accessed from the Internet.
4. Network Access Control Lists These are like Security Groups, but they operate at the Subnet level. Good for controlling which app layers can talk to each other, but not good for securing specific EC2 or RDS instances.
Thus, for an RDS instance to be publicly accessible, it must have all the following:
For your situation, I would recommend:
PubliclyAccessible to False. This will remove the public IP address.