VirtueCloud

Overview

Traditionally, accessing AWS RDS instances in private subnets required a bastion host in a public subnet and SSH keys for secure access. With AWS Systems Manager (SSM) and AWS CLI, you can simplify this process and securely access RDS instances without the need for a bastion host or SSH keys.

Prerequisites

To follow this guide, ensure you have:

AWS CLI: Installed on your local machine.
IAM Permissions: The EC2 instance (serving as a jump host) requires permissions for SSM and EC2 services.

SSM Agent: Installed and running on the EC2 instance.Note: The SSM Agent is pre-installed on most Amazon Machine Images (AMIs). For custom AMIs, manual installation may be necessary.

Install AWS CLI

On Windows: Download and install the AWS CLI from the official AWS CLI download page.

On macOS:

On Linux:

Verify the Installation: Verify the Installation: Run the following command to confirm the AWS CLI version is installed correctly.

aws --version

Configure AWS CLI

To set up the AWS CLI, you'll need your AWS Access Key ID, Secret Access Key, default region, and output format.

Run the following command:

aws configure

When prompted, enter the following details:

AWS Access Key ID and Secret Access Key: Generate these in the IAM console if needed.
Default Region: Enter the region where your RDS instance and jump host are located.
Default Output Format: Choose json, text, or table based on your preference.

Install Session Manager Plugin

Download and install the AWS Session Manager plugin for the CLI from the official AWS Systems Manager page. Verify the installation using the command:

Attach Role to EC2 Instance

Create an IAM Role in AWS Console

Choose AWS Service as the trusted entity and EC2 as the use case :

In Permissions Policies, select AmazonSSMManagedInstanceCore and click Next :

Name the role (e.g., EC2_SSM_ROLE) and create it :

Launch an EC2 Instance and Attach the IAM Role

Provide a name for the instance :

Retain default settings and proceed to the Key Pair section. Choose 'Proceed without a key pair' :

In Network settings, select your VPC, subnet, and security group :

Note: Ensure your VPC has a NAT Gateway if you're selecting a private subnet for AWS Systems Manager (SSM) connectivity. Without a NAT Gateway, opt for a public subnet to ensure internet access for the EC2 instance.

In Advanced details, select the IAM instance profile (EC2_SSM_ROLE) created earlier, then launch the instance :

Start an SSM Port Forwarding Session

To begin an SSM port forwarding session, use the command below:

Note : Substitute instance-id and rds-endpoint with your EC2 instance ID and the endpoint of your RDS database respectively.

Example Commands:

PostgreSQL Database:

MySQL Database:

Accessing the DB : After running the command, you can connect to your RDS database using localhost:5432 (or the specified local port).

Verifying Connectivity with DBeaver:

Download DBeaver from here.
Open DBeaver and select your database type (e.g., PostgreSQL).

Enter your database name, username, and password.

Click Test Connection to confirm connectivity, then select Finish to establish the connection.

Note: Even though this setup connects directly to the AWS RDS database without needing a bastion host, an EC2 instance (or other compute resources like ECS or EKS) within the same VPC as the RDS instance is still required for connectivity. However, you don't need to create a separate EC2 instance just for database access. Any EC2 instance, ECS worker, or EKS node within the VPC can be used to connect to the RDS database, ensuring a streamlined and efficient setup.

Conclusion

In this guide, we explored a secure and streamlined approach to accessing AWS RDS instances in private subnets using AWS Systems Manager (SSM) and the AWS CLI. By eliminating the need for traditional bastion hosts and SSH keys, this method simplifies infrastructure management while enhancing security.

With SSM port forwarding, you can securely connect to your RDS database without exposing sensitive credentials or managing intermediary hosts. Additionally, leveraging IAM roles ensures proper access control and follows AWS best practices for least privilege.

As organizations continue to prioritize cloud security and operational efficiency, adopting tools like AWS Systems Manager becomes essential. Whether you're managing databases in production or accessing instances in development environments, this method offers a scalable and secure solution.