I'm using RDS on multiple of my websites. Would it be a bad/unsafe idea to point a subdomain to that RDS server? Would this have negative security impacts?
2 Answers
If you assigned a public DNS record to the RDS instance it would allow people to query your DNS and get the underlying address of your database server. If you haven't enabled the "publicly accessible" flag on the RDS instance then it won't provide much of a security issue since someone would still need access to your VPC to gain access to the RDS instance.
A better solution is to create a new Route53 private hosted zone in your AWS account, and attach that to your VPC. A Route53 private zone allows you to create DNS entries that only resolve from within your VPC.
You can assign a subdomain to your RDS instances. This makes them easier to remember and / or manage. If you are using Route 53, use a CNAME record with the RDS endpoint.
However, think thru the security of this. Normally, you do not want databases to be publicly available. For most situations your databases should be in your private subnets to protect them from the public Internet.
If you need your databases on the public Internet, then protect them with well defined security groups and good password policies. Hackers will find your database no matter what domain name you call it. They scan the Internet using IP addresses.
Related