AWS RDS MySQL database publically avalible

Question

We currently have two EC2 instances and a RDS instance. Both a EC2 instance and the RDS instance a hosted on AWS in the same region. However, the second EC2 instance is on a different region.

Currently we have limited access to the RDS instance to only allow connections from the first EC2 instance using Amazon's VPC and security groups.

We need to allow the second EC2 instance to access the RDS database but currently cross region support for security groups/VPCs are not support. So it looks as though we need to open the RDS instance up to the public internet (looks as though we can limit it to the second EC2's IP address though).

What are the security concerns about doing this? It is running MySQL 5.6.27. It has a strong password associated with it's access (but I don't know if this is sufficient). I can provide more configure details if needed.

Thanks

Answer 1

Database protocols are not designed to support hostile public exposure. Even source IP protections may be insufficient, due to IP spoofing, lack of transit encryption and other issues.

Perhaps reconsider the architecture by either using a read replica in the second region and sending customers who need to do writes to the EC2s in the master region, or just by shutting down the other region EC2 instance.

The other-region deployment of EC2 may not help for performance, because transactions still have to travel to the master region. And it may not help for availability, because if the master region is lost then presumably the lone EC2 instance won't be able to do very much.

Answer 2

This happens pretty frequently. You have to trust your security groups.

Security groups let you reference instances (depending on your VPC configuration), so if it changes IPs, the instance is referenced in your SG, not the individual IP. Just make a tight SG that only allows connections from that one port from that single instance/IP.

You can turn on VPC Flow logs to make sure the only accepted connections are from your other DB server. There are some cheap/free tools in the AWS marketplace to help you consume the VPC Flow logs.

This is pretty common, security groups are trustworthy when configured correctly.