CODEWITHSUNDEEP
amazon-web-servicesdatabase-connectionamazon-rds
Z.Wei
Z.Wei

Reputation: 3938

Direct access a database in a private subnet without SSH tunnel

I have a database set up (use RDS) in a private subnet, and a bastion is set up in front of it in a public subnet. The traditional way to access this database from local laptops is to set up an ssh tunnel on that bastion/jumpbox and map the database port to local. But this is not convenient to development because we need to set up that tunnel everytime before we want to connect. I am looking for a way to access this database without setting up an ssh tunnel first. I have seen a case where the local laptop directly uses that bastion's ip and its 3306 port to connect to the database behind. I have no idea how it is done.

BTW, in that case I saw, they don't use port forwarding because I didn't find any special rules in the bastion's iptable.

Upvotes: 3

Views: 1809

Answers (1)

James Powis
James Powis

Reputation: 659

There are several ways to accomplish what you are trying to do, but without understanding the motivation fully it is hard to say which is the "Best Solution".

SSH Tunneling is the defacto standard of accessing a resource in a private subnet behind a public bastion host. I will agree that SSH Tunnels are not very convenient, fortunately, some ide's and many apps are available to make this as easy as a click of a button once configured.

Alternatively, you can set up a client to site VPN to your EC2 environment which would also provide access to the private subnet.

I would caution anything you do which proxies or exposes the DB cluster to the outside world in a naked way such as using IP tables, Nginx, etc. should be avoided. If your goal is this, then the correct solution is to just make the DB instance publicly exposed. But be aware any of these solutions which do not make use of tunneling in (such as VPN or SSH Tunnel) would be an auditory finding, and open your database to various attack vectors. To mitigate it would be recommended that your security groups should restrict port 3306 to the public IP's of your corporate network.

Upvotes: 2

Related Questions