Search code examples
amazon-ec2sshsubnetssh-tunnelprivate-subnet

How EC2 allow SSH tunelling to access RDS in private subnet?

To access RDS in private subnet, in the below architecture,

enter image description here

Giving public IP of EC2, ssh private key location of EC2 in public subnet, DB credentials of RDS in private subnet, as shown below,

enter image description here

How EC2(in public subnet) allow ssh tunneling to RDS in private subnet? Is it something to do with /etc/ssh/sshd_config in EC2?

Solution

  • From the picture, the EC2 instances share the same private network (class B) 172.16.X.X with the RDS therefore by having access to any instance in the public segment and depending on the security groups defined on the RDS it may be possible to reach the database by doing something like:

    ssh -L 3307:<db>.rds.amazonaws.com:3306 [email protected]

    The option -L will do a local port forwarding from port 3307 (your computer) to port 3306 in <db>.rds.amazonaws.com going through your.ec2.instance.

    You could use a bastion host to do this, you could read more about it here: https://docs.aws.amazon.com/quickstart/latest/linux-bastion/architecture.html

    Besides defining how and what users to allow using ssh you will not have to deal with sshd_config most of the work will be either in AWS security groups or how you defined your VPC or network ACL's.