15. Amazon RDS for MySQL: Create, Connect, Back Up and Keep It Private
15.2 Planning the Network: Subnet Group and Security Groups
RDS banvnyaadhi network plan kara. Nantar badalne tras aahe.
| Item | Setting for our project |
|---|---|
| VPC | The same VPC as your EC2 web server (default VPC is fine for learning) |
| DB subnet group | At least two subnets in different Availability Zones (private subnets in production) |
| Public access | No |
| Security group for EC2 | web-sg: inbound 80/443 from anywhere, 22 from your IP only |
| Security group for RDS | db-sg: inbound MySQL/Aurora 3306 with source = web-sg (the security group, not an IP) |
Using a security group as the source means "any instance that has web-sg attached may connect" – if the web server's IP changes, the rule still works, and nothing else in the world can reach 3306.
# create db-sg and allow 3306 only from web-sg (IDs are placeholders)
aws ec2 create-security-group --group-name db-sg --description "RDS MySQL" --vpc-id vpc-0abc1234
aws ec2 authorize-security-group-ingress --group-id sg-0db11111 \
--protocol tcp --port 3306 --source-group sg-0web2222
aws ec2 describe-security-groups --group-ids sg-0db11111 --query "SecurityGroups[0].IpPermissions"
Why this matters for security
Port 3306 open to 0.0.0.0/0 is one of the first things scanners like Nmap and Shodan-style search engines find. Attackers then run password brute force against the database directly. With a private DB and a security-group-to-security-group rule, the database simply does not exist for the internet.
Ravindra Bagale's Tip
Because they can't connect, students put source 0.0.0.0/0 in db-sg – "I'll remove it later" – and forget. Never! Choose web-sg as the source. If you really need to look at the database from your laptop, use an SSH tunnel (shown in 15.4).
Ravindra Bagale's Tip – मराठी
Connect होत नाही म्हणून students db-sg मध्ये source 0.0.0.0/0 टाकतात – "नंतर काढू" – आणि विसरतात. कधी नाही! Source मध्ये web-sg निवडा. Laptop वरून database बघायचाच असेल तर SSH tunnel वापरा (15.4 मध्ये दाखवलं आहे).
Ravindra Bagale's Tip – हिंदी
Connect नहीं होता इसलिए students db-sg में source 0.0.0.0/0 डाल देते हैं – "बाद में हटा देंगे" – और भूल जाते हैं. कभी नहीं! Source में web-sg चुनो. Laptop से database देखना ही हो तो SSH tunnel इस्तेमाल करो (15.4 में दिखाया है).
Practice task
Create web-sg and db-sg in your VPC. Add the 3306 rule to db-sg with web-sg as the source and take a screenshot of the inbound rules for your notes.