2 Answers
- Newest
- Most votes
- Most comments
2
Note I want my database to be publicly available.
Is there a reason for database to be publicly available? This is, as you mention, not secure.
Would suggest you enable App Runner VPC access, and access your RDS instance through it. More at Deep Dive on AWS App Runner VPC Networking
Edit
If you still want to access it through public IP, you can try the following:
- Enable App Runner VPC access
- When you connect App Runner service to a VPC, the outbound traffic does not have access to the public internet, as you can only select private subnets. Connect the private subnets to the internet through a public NAT Gateway
- NAT gateways are associated with Elastic IPs, which are static, public IPv4 addresses. Update your RDS security group inbound rules to allow connections from NAT gateway public IP
More information at Enabling VPC access for outgoing traffic. Note that if the security group is configured, incorrectly, you may inadvertently expose your RDS to public internet.
Relevant content
asked a year ago
Yes there is some reason. Can you share me options to whitelist app runner request using current setup.(public rds) Is there a way. If there is no option I will proceed with alternative
Without VPC access, the IP associated with your App Runner service outbound internet access is likely to be dynamic, i.e. always changing. I have updated my post about using VPC access with NAT Gateway for IP allow-listing
Even though its dynamic is there a range ? I saw something like https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-ip-address.html . Similarly is there a range for App Runner ?? If so please share so that we can use that range in security group.
I am not aware of documented range specifically for App Runner. You can refer to ip-ranges.json, and allow-list all the IP prefixes in your Region. Refer to https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html and https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-work-with.html#filter-ip-ranges-region. This option is not secure and you need to keep your SG list up-to-date regularly as new IPs are added.