pass requests between public and private subnets AWS

Question

I have 2 Nginx servers behind a load balancer. These servers are in a public subnet. I have a MongoDB instance and that is in a private subnet. Both are in the same VPC. My question can I route the traffic from my load balancer to the MongoDB and receive a response from my MongoDB without having a NAT gateway or bastion server. I know a NAT gateway or a bastion server is needed to ssh into my instance but that is not my purpose. I just want to receive responses from my MongoDB in the private subnet

Answer 1

All resources in the same VPC can communicate with each other, regardless of subnet.

Simply make sure that the Security Group on each resource permits the inbound connection.

For example, you should have:

• A security group for the load balancer (LG-SG) that permits incoming traffic from the Internet
• A security group for the Nginx servers (NGINX-SG) that permits incoming traffic from LG-SG
• A security group for the MongDB server (MONGO-SG) that permits incoming traffic from NGINX-SG or LG-SG (depending where incoming traffic is coming from)

By default, security groups are configured to permit all Outbound traffic, and security groups are stateful. This means that responses to requests will automatically be able to return to the sender. There is no need to specifically permit return-path access.