Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Publicly accessible RDS instance with Verified Access

0

Is it possible to have a publicly available RDS instance configured with verified access?

Here is my use-case: I have a public RDS instance. I have an external service that accesses the DB and some developers who access it as well from different locations. My goal is to close the DB to the internet, but keep allowing access to the external service and developers. My idea was to create a security group that allows only access to the IP address of the external service, and setup verified access to allow developers to connect to it.

What I did? I've setup a public instance with verified access but it doesn't work. It seems to resolve the verified access endpoint but I get a timeout. To check that the issue is the instance being publicly available, I removed public access from it, and verified access worked.

Asking Q (the chatbot), I understand that this configuration is not compatible with verified access. Is this true? Why is it incompatible? Is there a workaround to it? (I don't want to use a Bastion server or VPN)

Topics
Networking & Content DeliveryDatabase
Tags
MySQLAWS Verified Access
Language
English

asked 2 years ago321 views

1 Answer
0

as you said "My goal is to close the DB to the internet, but keep allowing access to the external service and developers.

you should modify the instance's settings to make it "Not Publicly Accessible" and ensure your security group rules restrict access to only authorized private networks. in RDS console select your RDS and click modify(in this page go to connectivity and Additional configuration and choose "Not publicly accessible" it will ask you "Schedule modifications When to apply modifications Apply during the next scheduled maintenance window Current maintenance window: April 08, 2025 00:05 - 00:35 (UTC-07:00) Apply immediately The modifications in this request and any pending modifications will be asynchronously applied as soon as possible, regardless of the maintenance window setting for this database instance." ) .

( (this may require a downtime)

then configure your security group to only allow access from:

Your external service's specific IP address

The CIDR range used by your Verified Access endpoint

this "private-only" setup with specific allowed exceptions through security groups.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content