Search code examples
amazon-web-servicesaws-lambdanatamazon-vpc

Route public traffic to VPC

I have an Aurora database on a VPC. Today I needed to connect to that database through Lambda. Not really an issue except I needed internet access in that Lambda and so I had to setup the following:

  1. I added a new subnet for the public NAT.
  2. I added a NAT Gateway and assigned it to a new EIP and the new subnet.
  3. I added a new route table that routed all traffic to the igw and associated that table with the new subnet I created in step 1.
  4. I modified the Main route table and routed all traffic to the NAT.

This gave me internet access in my Lambda, and by running the Lambda on the VPC, I also had access to my Aurora database.

However, I have now lost public access to this database through MySQL Workbench.

What do I need to configure to route the public traffic back to the VPC?

Solution

  • The fact that you could previously connect to the Amazon Aurora data base from your laptop suggests that Aurora was running in a Public Subnet. That is, a subnet that has a Route Table that sends Internet-bound traffic directly to the Internet Gateway.

    You mention that you modified the Main routing table. It is likely that this routing table is associated with your Public Subnet (where Aurora is located), and that it was previously configured to send traffic to the Internet Gateway. However, it was probably modified to send traffic to the NAT Gateway. Therefore, the subnet was effectively changed into a Private Subnet (with no Route Table entry that points to the Internet Gateway).

    If you really do want your database in the public subnet, then the configuration would be:

    • One public subnet, which contains the Aurora database and to which the Lambda function connects
    • A Route Table associated with the subnet that routes Internet-bound traffic (0.0.0.0/0) to the Internet Gateway
    • Possibly an additional subnet to provide High Availability for both Aurora and Lambda

    No private subnet is required since you want Aurora in a public subnet.

    A more secure option would be:

    • A public subnet with a jump box EC2 instance and the Lambda connection
    • A private subnet with Aurora

    To connect to Aurora from your laptop, you would SSH into the Jump Box and use port forwarding to access the Aurora database. This way, the database is not exposed to the Internet.

    The public subnet would have a different route table than the private subnet (thus making them private/public).