15. Amazon RDS for MySQL: Create, Connect, Back Up and Keep It Private
15.2 Planning the Network: Subnet Group and Security Groups
RDS banvnyaadhi network plan kara. Nantar badalne tras aahe.
| Item | Setting for our project |
|---|---|
| VPC | The same VPC as your EC2 web server (default VPC is fine for learning) |
| DB subnet group | At least two subnets in different Availability Zones (private subnets in production) |
| Public access | No |
| Security group for EC2 | web-sg: inbound 80/443 from anywhere, 22 from your IP only |
| Security group for RDS | db-sg: inbound MySQL/Aurora 3306 with source = web-sg (the security group, not an IP) |
Using a security group as the source means "any instance that has web-sg attached may connect" – if the web server's IP changes, the rule still works, and nothing else in the world can reach 3306.
# create db-sg and allow 3306 only from web-sg (IDs are placeholders)
aws ec2 create-security-group --group-name db-sg --description "RDS MySQL" --vpc-id vpc-0abc1234
aws ec2 authorize-security-group-ingress --group-id sg-0db11111 \
--protocol tcp --port 3306 --source-group sg-0web2222
aws ec2 describe-security-groups --group-ids sg-0db11111 --query "SecurityGroups[0].IpPermissions"
Why this matters for security
Port 3306 open to 0.0.0.0/0 is one of the first things scanners like Nmap and Shodan-style search engines find. Attackers then run password brute force against the database directly. With a private DB and a security-group-to-security-group rule, the database simply does not exist for the internet.
Ravindra Bagale's Tip
Connect hot nahi mhanun students db-sg madhe source 0.0.0.0/0 taktat – "nantar kadhu" – aani visartat. Kadhi nahi! Source madhe web-sg nivda. Laptop varun database baghaychach asel tar SSH tunnel vapra (15.4 madhe dakhavla aahe).
Practice task
Create web-sg and db-sg in your VPC. Add the 3306 rule to db-sg with web-sg as the source and take a screenshot of the inbound rules for your notes.