1

I have a Postgres database hosted in AWS RDS. The rest of my application is also hosted on AWS. The database migrations, like adding a new column, are done by Prisma, a node package. The pipeline is on GitHub Actions. There I run npx prisma migrate deploy script to modify the database on every deployment. To make it more secure, I created a random username, safe password, and port number different than the standard one.

How dangerous it is to make the database publicly accessible so that GitHub Actions can do the migrations on the database?

What other solution would you suggest to be able to run the migrations from the Github Actions?

Improve this question
3
  • have you considered a self-hosted runner in your environ? docs.github.com/en/actions/security-guides/…
    – brynk
    Apr 14 at 15:46
  • Yeag, that is a good option. But if there is an easier but safe solution, I would still like to hear it
    – Jöcker
    Apr 15 at 6:46
  • i'd be looking to restrict the ip addies that can access the rds instance (maybe using a security group/s), however, i read that there are many github ip addies and they recommend checking the api weekly - from memory, you can have up to 32k rules in a security group - at the moment there are 3k action ip-cidr entries: too many to handle manually
    – brynk
    Apr 15 at 11:40

1 Answer 1

Reset to default
0

Based on what the AWS support answered me, there are the following options to do that:

  1. Alter the solution to make use of a bastion host that can receive connections from the internet and run the script from the bastion. You can use this CDK library for that.
  2. Use an EC2 instance as a self hosted GitHub Action runner
  3. Allow connection to your instance over the public internet using the options available, due to dynamic IP this option would be difficult to achieve (not recommended)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .