Access Database Server hosted in AWS private subnet - amazon-web-services

I have gone through AWS VPC(Virtual Private Cloud) where I can have public, Private and VPN-only Subnets.
With this, I want to host a Database in Private or VPN-only subnet.
Now that, Private and VPN-only subnet can not have Internet traffic, I wonder if I can access my database server from remote machine (not an EC2 instance nut any random machine on internet) ?
So All I want to know that, how I can access my Database server from random machine using VPN connection ? So the only users those have VPN connections can access the database server. I want this for development purpose.
Any comments links will be helpful.
Note: I am aware that I can do this with VPN EC2 instance, but I don want to have one and directly connect to Database server from remote machine which has VPN connection.
Thanks

When you create a private VPC, all of the subnets you create within it have internal network access to each other by default in their route tables. However you would need to configure a NAT or Bastion instance within the VPC that is public to act as the gateway to the private database.
The private database would need to have an appropriate security group attached to it to allow it to be accessed by the public machine. See about VPCs and Security Groups here.

Related

AWS Client VPN Access Public URL/IP

I have an AWS Landing Zone Setup.
My Shared Account contains an AWS Client VPN.
My Network Account contains Transit Gateway, this is shared with Production Account and Production Account VPC is attached.
My Production Account contains a VPC which initally had Private Subnet and one EC2 Instance.
Initially my team wanted to login to the EC2 and install some softwares. This setup was successfull and my team has completed their work.
Now,Due to some requirement changes (they have configured a Website) over the Instance, I changed my Private Subnet to Public Subnet by introducing IGW entry in the Route Table. Also, I have attached an Elastic IP.
One of the other team wanted to connect to this URL/Portal, so I have added their corporate VPN Public address in the Security Group. They are able to access the website/portal/url easily.
Now my team wants to access the URL, but they are not able to access it and I cannot make it Public or Open to world
Other Configurations:
Current Security Group contains Inbound All Traffic from AWS Client VPN and the Corporate VPN
DNS entries and resolution is done by other team, they have made entry for the Public IP and the URL to which it should resolve
What changes I should make so that my team can connect to VPN and should be able to access this portal/URL?
I added the entires of my URL in my local machine host file and mapped it to my EC2 Private IP.
Now I can connect to my VPN and access the URLs from my browser.

JDBC connection to mySQL RDS instance in a private subnet

We are trying to find out ways to make a JDBC connection to a SQL Server hosted in a private EC2 instance or a private subnet.
Basically, we have an Excel-based small BI report that connects to an On-Prem SQL server and we want to move that DB to cloud and just switch the end points.
There is a lot of information out there about SSH connections to a private subnet RDS SQL server through bastion hosts etc, but I have not found anything related to direct connection.
Due to the infra set up, VPN and direct connect is not possible to use and the users will be directly connecting to private RDS instance over a public internet.
I have not found anything related to direct connection.
Without VPN or Direct Connect, direct connection is not possible. Your RDS is in private subnet, as there is no direct internet connectivity to it - thus the name "private".
If you don't want to use VPN and/or don't have Direct Connect, then the only option is to use ssh tunnel through a bastion host as explained by AWS:
How can I connect to my Amazon RDS DB instance using a bastion host from my Linux/macOS machine?

NAT Gateways-how do you go about SSH'ing into the private EC2?

When you set up an EC2 instance in a private subnet to access the internet through a NAT gateway (with all the necessary routing and association through route table), how do you go about SSH'ing into the private EC2?
For example, EC2 in the NAT Gateway public subnet and making a connection through the public EC2 to the private EC2.
NAT Gateway is for outgoing traffic only.if you have to access the private EC2 instance then you need bastion on public subnet in same VPC.
OR VPN to connect or AWS system manager.
There are three options that are commonly used:
Use a bastion host in a public subnet. First you ssh to the bastion, and then ssh from the bastion to the private ec2. This usually requires copying private ssh key to the bastion so that you can use it there to ssh to the private subnet.
Use a SSM session manager. This probably would be the easiest option to setup as you already are using NAT and it requires special instance role.
Use a VPN. Probably the most complex solution but also used nevertheless.
As the instance is in a private subnet you will need to use a method to connect to this privately. There are many options to choose from, they will vary in cost and complexity so ensure you read each one first.
Site-to-site VPN - Using this method a managed VPN is added to your VPC and connected to your on-premise via hardware configuration. Your security groups will need to allow your on-premise CIDR range(s) to allow connection.
Client VPN - Using either AWS solution, or a third party from the marketplace (such as OpenVPN) you can establish a connection using either a local program or HTTPS in your browser.
SSM Sessions Manager - Access your EC2 instance via the AWS console or using the CLI, portrayed as a bash interface without using SSH to authenticate. Instead IAM is used to control permissions and access.
Bastion host - A public instance that you can connect to as an intermediary either using SSH to connect to before accessing your hsot, or as a proxy for your commands.

moving from publicly accessible rds database to using bastion ec2 instance to connect to it

If one has a publicly accessible rds database on aws, and wants to instead use a bastion ec2 instance to access and perform database functions (anyone on the internet should be able to use the app and perform database functions in accordance with the features provided by the app), how should one go about performing this shift? I have tried searching the internet but often I get loads of information with terminology that isn't entirely easy to digest. Any assistance would be greatly appreciated.
Again, I want the general public to be able to use and access the app's provided db functions, but not have them be able to access the database directly.
A typical 3-tier architecture is:
A Load Balancer across public subnets, which sends traffic to...
Multiple Amazon EC2 instances in private subnets, preferable provisioned through Amazon EC2 Auto Scaling, which can scale based on demand and can also replace failed instances, which are all talking to...
A Database in a private subnet, preferably in Multi-AZ mode, which means that a failure in the database or in an Availability Zone will not lose any data
However, your application may not require this much infrastructure. For low-usage applications, you could just use:
An Amazon EC2 instance as your application server running in a public subnet
An Amazon RDS database in a private subnet, with a security group configured to permit access from the Amazon EC2 instance
Users would connect to your application server. The application server would connect to the database. Users would have no direct access to the database.
However, YOU might require access to the database for administration and testing purposes. Since the database is in a private subnet, it is not reachable from the Internet. To provide you with access, you could launch another Amazon EC2 instance in a public subnet, with a security group configured to permit you to access the instance. This instance "sticks out" on the Internet, and is thus called a Bastion server (named after the part of a castle wall that sticks out to allow archers to fire on invaders climbing the caste wall).
You can use port forwarding to connect to the Bastion server and then through to the database. For example:
ssh -i key.pem ec2-user#BASTION-IP -L 3306:DATABASE-DNS-NAME:3306
This configures the SSH connection to forward localhost:3306 to port 3306 on the named database server. This allows your local machine to talk to the database via the Bastion server.
You will need to create private subnets for this and update DBsubnet groups accordingly with private subnets only. Moreover in DB security group add bastion and app instances security group as source for db port.
Like if you're using mysql engine, allow 3306 for target instances secuirty group id's.

AWS NAT gateway vs public IP for outgoing internet connections

I'm learning AWS and how to configure networking for EC2 instances and have a few questions. I'm using CentOS 7 in t2.micro instances.
The private IP is tied to the NIC in the instance as shown by ifconfig -a. The purpose seems to be a single point of contact for the server. Adding another network interface does NOT add another NIC as shown by ifconfig -a. Since the primary network interface cannot be a static IP, a secondary network interface is necessary for most configurations. For example, to connect the application to the database server, use the static IP assigned to the second network interface. Am I understanding this correctly?
The public IP is shown in the AWS console and provides a means to connect to the instance via SSH, assuming you configure the SG. The public IP also provides a means to access the internet for system updates. This seems to contradict the AWS documentation for NAT. If the public IP already provides internet access, why is a NAT (instance or gateway) needed? This is in reference to system updates which the documentation references.
You can use a NAT device to enable instances in a private subnet to connect to the Internet (for example, for software updates) or other AWS services, but prevent the Internet from initiating connections with the instances. A NAT device forwards traffic from the instances in the private subnet to the Internet or other AWS services, and then sends the response back to the instances.
Is a public IP and private IP are always assigned to each instance? I haven't walked through the process of creating an [new] AMI to verify if there's an option to not have a public IP. If the instance doesn't have a public IP, will the AWS console Connect button still allow you to connect to it to administer the server? Under what scenario will an instance NOT have a public IP? How do you connect to that instance to administer it?
I have read the NAT Gateway documentation and understand much of it. I'm having trouble understanding the pieces that state a NAT gateway or internet gateway is necessary to enable internet access, when it seems this is enabled by default. What am I missing?
I think your confusion stems from your third question. A public IP is not always assigned to an instance. Public IP is an option that you can enable or disable in public VPC subnets, and in private VPC subnets public IP isn't an option at all. For EC2 instances without a public IP a NAT gateway (or NAT instance) is required in order to access anything outside of the VPC.
You may want to place something like a database server in a private subnet so that nothing outside your VPC can ever access it. However you might want the database server to be able to access the Internet to download patches or something, or you may want it to access the AWS API in order to copy backups to S3 or something, in which case you would need a NAT Gateway to provide the server access to resources outside your VPC.