When I ping the RDS endpoint from my computer it shows the Private IP of the RDS
We are trying to configure a VPC, which has a private subnet and a public subnet. In the private subnet there is an RDS which is not publicly accessible. We have test it and seems that works fine! The issue though its that when I ping the RDS endpoint from my computer it returns the Private IP of the RDS (its not returns any packets though).
We do not want to shows the Private IP.
Any help would be appreciated!
I went ahead and popped open a chat with our AWS support team to pick their brain. Basically, this boils down to how they host their DNS mappings for RDS endpoints; they're created in a public hosted zone by default (not modifiable). Hence, you can resolve your RDS endpoint over the internet (because the mapping is hosted publicly), but can't actually route any data to it.
If this is an issue, to get around it you can ... jump through some hoops:
An alternative will be to create a private hosted zone with a record that points to the rds endpoint. (for example a private hosted zone "xxxx.com" that has an alias record pointing to rds endpoint), in which case you will reach out to your rds instance using xxxxx.com
However, this doesn't actually disable the original AWS created endpoint from returning the private IP, it just allows you to configure an endpoint that doesn't.
For what it's worth, revealing your private IP is pretty harmless; several thousand devices likely share your exact private IP. The only way this information would be concerning for you is if an attacker was actually in your network - and at that point... they could just do a lookup on the DNS from there to get the IP.