Should a non-public RDS instance have a publicly resolvable DNS name?
So, I spun up a RDS PostgreSQL database instance, and chose the 'Not Public' option. The instance was created with DNS name: pg-rds-db-instance-1.caqxluy95kpl.us-east-1.rds.amazonaws.com
Since this is not a public instance, I would expect that the DNS name is not publicly resolvable. However this is not the case. I can do a DNS lookup using multiple public websites such as MXTOOLBOX or https://toolbox.googleapps.com/apps/dig/#A/, and the DNS name resolves to an IP in my private subnet (172.16.4.87). This seems odd to me.
Is this expected behavior?
Yes, this is the expected behavior. Or at least this is how most AWS resources handler resolving their name.
It is seems like a security risk because a hacker seems to be able to find out information about the internal workings of your infrastructure but that is not necessarily the case.
You have to realize that the returned IP address is from private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). These IP address ranges wil not resolve to anything when used on the internet. Pinging or tunneling to them does not work.
So the only thing exposed is something of your internal infrastructure. But you have to realize that a abuser has to know the name of the resource before he can find out the internal IP address. So the only thing you have to do is keep the name a secret as you would do with other sensitive information.
RDS Postgresql migrate to Aurora Postgresql. Not showing "Aurora read replica" & "Migrate snapshot" options.Accepted Answerasked 4 months ago
Connection to MariaDB server gets a timeout, out of nowhere.asked 3 years ago
Should a non-public RDS instance have a publicly resolvable DNS name?asked 5 months ago
RDS Database Instance does not show up in dropdown when creating RDS Proxyasked 3 months ago
Can't connect to RDS database from remoteasked 3 months ago
RDS instance stuck in Deleting stateasked 2 years ago
"Create Aurora Read Replica" option not available to migrate from RDS Postgres 11.12 to Aurora 11.12.asked 2 months ago
Issues connecting to Postgres RDS instance from within a VPCasked 3 years ago
AWS Lambda not able to connect to public RDS instanceasked a month ago
RDS does not support creating a DB instanceasked 3 months ago