Access AWS RDS from Private Subnet

Question

I created an AWS VPC with public and private subnet.

I created an RDS(MySQL) inside private subnet. I want to access the RDS from internet (From my home machine).

I have kept the flag Publicly Accessible Yes. Also in the RDS security group, I tried to open port3306 for all IPs (I know not recommended but still) as well tried all ports with all IPs (the worst security ..I know) and tried to access but nothing worked. I can access the RDS from bastion machine created in public subnet but from internet I can not.

Do you think, am I required any other setting?

I verified ACL and they are fine too.

Any help would be appreciated.

Sedlik

Answer 1

You cannot access instances in a private subnet from the internet - that is the point of a private subnet.

Either access it thru the bastion machine, or put it in the public subnet.

Edit:

There is a good description of different options here. If you put your RDS instance into a private subnet, then it is not accessible from the internet. So if you need access from the internet, it must be placed in a public subnet.

Shannon

I think you can access. When I read the article at docs.aws.amazon.com/AmazonRDS/latest/UserGuide/… which says you are required to enable DNS Hostname as well ensure RDS is publicly Accessible. Even it points to docs.aws.amazon.com/AmazonRDS/latest/UserGuide/… which says similar. – Sedlik

I find the example in the doc unclear too. After many googling, I finally found the doc that explicitly says public subnets are required for the option to work. docs.aws.amazon.com/AmazonRDS/latest/UserGuide/… – Yapon

Answer 2

Very late response, but you could set up a bastion server in the public subnet and set up an ssh tunnel through that bastion server.

Godolphin

Answer 3

Update in 2024 with more options.

1. Make a bastion host and then set an SSH tunnel. There are plenty of websites out there describing it [1]. Essentially, you will create an EC2 instance in a public subnet in the same VPC as the private DB host, allow inbound traffic on the relevant database port from the IP you need, allow DB assess from the bastion host security group, and then create a ssh tunnel with your main server. There are a few other details like making sure the routes are all correct but that's a high-level summary.
2. Connect through a Client VPN. You can add a VPN to your VPC. What this allows you to do is gain access to your VPC through your local computer. If it is configured correctly, when your VPN connection is live, and you connect to 10.0.0.20, it will route the traffic through your VPC instead of through the public internet. This gives you access to the private subnet.
3. Site-to-site VPN or Direct Connect. These are lumped together because I've already described the process above. Essentially, you gain access to your VPC and access the private subnet through your route tables[2].
4. Aurora Query Editor. It isn't available in all regions but you should be able to have access to basic queries if you're using Aurora and are in a supported region [3].

References

1. https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/access-a-bastion-host-by-using-session-manager-and-amazon-ec2-instance-connect.html
2. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.Scenarios.html#USER_VPC.NotPublic
3. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/query-editor.html

Outrider

Answer 4

if the RDS was in private subnet:

AWS Doc: At the present time, updating an existing DB Subnet Group does not change the current subnet of the deployed DB instance; an instance-type scale operation is required. Explicitly changing the DB Subnet Group of a deployed DB instance is not currently allowed.

There is two options after you change the DB Subnet Group: Option 1) Delete / take final snapshot of the RDS & restore the snapshot with the public subnet. (as in 2016 July)

Option 2) Change instance type scale to large then small again

Aarau

Can you please link to the AWS documentation you are referencing? – Elissaelita