Access to RDS port via EIC Endpoint through --local-forwarding from remote host

Question

We've setup EIC Endpoint and I have seen several posts that show that tunneling/forwarding was turned off a year ago - and that only 22 and 3389 ports should be allowed. But we setup EIC to an SG that allows anywhere in the VPC via IP(using VPC ip range) and we are able to connect to RDS port on Postgres 5432 using connection. - and it works - it this a change? (it first allowed this and then was shutoff a month later)

aws ec2-instance-connect ssh --instance-id i-xxxxxxxxxxx36 --profile userservices --connection-type eice --local-forwarding 5432:application-postgres.cluster-cjaxxxxxxxxxxx.us-east-1.rds.amazonaws.com:5432

So local forwarding is taking forwarding on the host we connect to at i-xxxxxxxxx(in shared services account) and forwarding to to 5432 on the rds server in our dev account

Any ideas how? What is the magic here?
Thanks!

Riku_Kobayashi · Answer

Hello.

As you may know, when trying to connect to RDS via EC2 Instance Connect Endpoint, the following error occurs.  
I also confirmed that port forwarding to RDS was possible for a few days after this feature was announced, but I have confirmed that it no longer works after a few days.  
I think the fact that ports other than ports 22 and 3389 can be used was probably an unintended behavior by AWS.  
```
awscli.customizations.ec2instanceconnect.websocket - ERROR - {"ErrorCode":"InvalidParameter","Message":"The specified RemotePort is not valid. Specify either 22 or 3389 as the RemotePort and retry your request."}
```

As an alternative, you can use port forwarding using Systems Manager Session Manager.  
https://aws.amazon.com/jp/blogs/mt/use-port-forwarding-in-aws-systems-manager-session-manager-to-connect-to-remote-hosts/

DrewIngersoll · Answer

Well I get to it via instance connect and not SSM - it's doing dynamic port forwarding - probably via the openssh client and the jumphost I have(AWS Linux 2). It's cool that it works - I was just expecting the error message and I do not get it

DrewIngersoll

answered 2 years ago

Access to RDS port via EIC Endpoint through --local-forwarding from remote host

Add your answer

Relevant content