AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
connect to db in a private vpc with app runner vpc connector
Hi Ya'll
I am unable to connect to my dev database from my own network and I am hoping someone has a solution.
I have an RDS instance(postgres-serverless) running on a dedicated VPC
The VPC consisting of three private subnets and a public subnet.
The three private subnets are connected to a route table that is connected to a NAT gateway.
The public subnet is connected to an internet gateway.
I then have an app runner instance where I had to use a vpc connector in order to allow access both to the private subnets (db access), but also access to external services e.g. connecting to mail service to send emails.
My problem is that I cannot have this running and at the same time connect to the dev database by whitelisting my ip in the security group.
I know this approach (security group whitelisting) works because I have another VPC where I do just that. I also remember reading somewhere that the use of the VPC connector did cause issues with this type of access, but I am hoping some one has a solution.
I have tried assigning all 4 subnets to the route table that is connected to the internet gateway, but this alone is not enough, and does also break the intent of the setup =(
- Newest
- Most votes
- Most comments
To connect to your RDS instance in a private subnet while maintaining your App Runner setup, you need a secure approach that doesn't compromise your architecture.
Your current issue occurs because RDS instances in private subnets are intentionally isolated from direct internet access for security reasons. When you use an App Runner VPC connector, it's designed to allow your App Runner service to access resources in private subnets, but this doesn't automatically enable external access to those resources from your local network.
Here are some secure approaches to connect to your private RDS instance:
-
Create an EC2 instance in a public subnet of the same VPC, then use it as a bastion host to establish an SSH tunnel to your RDS instance. This allows you to connect securely without exposing your database directly to the internet.
-
Test connectivity using an EC2 instance within the same VPC as the RDS instance to verify your network configuration is correct.
-
Ensure your security groups are properly configured:
- The RDS security group should allow inbound traffic from your App Runner service's security group
- If using a bastion host, the RDS security group should also allow traffic from the bastion host's security group
- For your App Runner VPC connector:
- Verify you're using private subnets (not public subnets)
- Check that the security group ingress and egress rules are correctly configured
Moving all your subnets to the internet gateway route table isn't recommended as it defeats the security purpose of private subnets and could potentially expose your database to unwanted access.
The best practice is to maintain your private subnets for the database and use a secure method like a bastion host or AWS Systems Manager Session Manager to connect to your database for debugging purposes.
Sources
Community | Connect securely to an RDS instance
How to Successfully Connect AWS App Runner with a Privately Accessible RDS Instance? | AWS re:Post
Enabling VPC access for outgoing traffic - AWS App Runner
How to Successfully Connect AWS App Runner with a Privately Accessible RDS Instance? | AWS re:Post
When the service fails to connect to Amazon RDS or downstream service - AWS App Runner
In case it helps anyone then the solution was to create an ec2 instance in the VPC public subnet and then RDP into it and perform any db actions from there.
Relevant content
asked a year ago
