Skip to content

How to expose an IP address or host name from a peered VPC to the public but restrict access to a few ip addresses?

0

I have an interesting problem. I have a managed timescale database that is part of a VPC that I do not control. The timescale VPC is connected to my VPC via VPC Peering. From inside my VPC I can access the database from the peered VPC using something like this: psql "postgres://tsdbadmin@test.g8natb8ddx.vpc.tsdb.forge.timescale.com:5432/tsdb?sslmode=require" (I was able to find the IP address of the database so it's ok if I can expose that also) What I'd like to achieve is to expose this database publicly but limit access to a handful of IP addresses.

1 Answer
3

If you have the permission from the resource owner to do what you are asking and assuming that the peered VPC is using private IP addresses (anything under 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16), you could set up a network load balancer (NLB) and point its target group to the IP addresses of the database in the peered VPC. You can configure the NLB as internet-facing to give it public IP addresses and associate a security group with it to control which source IPs are allowed to connect.

If the IP addresses of the target database change occasionally, there's no completely perfect way to relay connections to it in this manner, but you should be able to get close by using EventBridge Scheduler to run a Lambda function regularly, such as every 1-5 minutes, that looks up the IP addresses of the target from its DNS name and updates the NLB's target group with the IPs if they don't match the current contents of the NLB's target group.

EXPERT

answered 2 years ago

EXPERT

reviewed 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.