Ravi Sir's Cyber Security Cards › Interview Cards
Should RDS or MySQL listen on the public internet?
Should RDS or MySQL listen on the public internet? No. Keep the database private and allow port 3306 only from the app’s security group. Put RDS in a private subnet. The app connects over the internal network, not the public internet. “Public MySQL is a classic small-shop breach. I bind it private a
Read card text
What this card says
Short answer
No. Keep the database private and allow port 3306 only from the app’s security group.
Example
Put RDS in a private subnet. The app connects over the internal network, not the public internet.
Say it in the interview
“Public MySQL is a classic small-shop breach. I bind it private and scope 3306 to the app SG.”
Why it matters
A database open to the world is scanned and dumped within minutes.
Learn more in the lesson: 46.4 Web Servers and MySQL Interview Questions