How to use SSH Tunnel to connect to an RDS instance via an EC2 instance?

user_915672 0
Viewed 12667

So this is really new to me, so apologies if this is a dumb question.

I have a RDS instance that is not publicly accessible and is sitting in its own private VPC. I have an EC2 instance that is allowed to connect to RDS, but nothing else is allowed to connect to the instance.

I now want PgAdmin to be able to show data from my RDS instance.

I went through the wizard in PgAdmin, I put in the EC2 Instance's Public IP as Tunnel host, the username is ec2-user and the authentication is by identity file (using the pem file that I use to ssh into the instance).

However, I still can't connect. In the Advanced tab, PGAdmin asks for a Host address, but complains when I put in my RDS instance's endpoint.

How do I get my local pgAdmin to now access my DB which is no longer accessible to the public internet?

--- forgot to add the error message

Unable to connect to server:

Failed to create the SSH tunnel.
Error: Could not establish session to SSH gateway
amazon-rds pgadmin amazon-web-services postgresql
2 Answers

To reproduce your situation using a SSH Tunnel in PgAdmin, I did the following:

  • Launched an Amazon RDS database with:
    • Public accessibility: No
    • Security Group: Permit inbound access on 5432 from 10.0.0.0/16 (the CIDR of the VPC)
  • Launched a publicly-accessible Amazon EC2 instance in the same VPC
  • Configured PgAdmin "SSH Tunnel" as:
    • Tunnel host: Used the DNS Name of my EC2 instance
    • Tunnel port: 22
    • Username: ec2-user
    • Authentication: Identity file
    • Identity file: Used the keypair I would use the SSH into the instance
  • Configured PgAdmin "Connection" as:
    • Host: Endpoint from Amazon RDS console
    • Port: 5432
    • Database, Username, Password as set when launching the Amazon RDS database

It connected successfully.

If it is hanging for you, check that the Security Group is allowing an incoming connection from the EC2 instance.

SSH Tunnel

Connection

user_1747770

It appears that you wish to use an Amazon EC2 instance with port forwarding to access a private Amazon RDS instance that is in the same VPC.

Here is how I configure such connections.

1. Confirm that SSH works to the EC2 instance

First, confirm that you can SSH into the EC2 instance. You would use a command similar to:

ssh -i key.pem ec2-user@IP-ADDRESS

2. Use port forwarding

If the above works, then modify the SSH command to use port forwarding:

ssh -i key.pem -L 5432:RDS-HOST-NAME:5432 ec2-user@IP-ADDRESS

This will forward port 5432 on your own computer to the EC2 instance via SSH. Then, any traffic sent to localhost:5432 will be forwarded across the SSH connection. The EC2 instance will then send the traffic to RDS-HOST-NAME:5432. (Replace RDS-HOST-NAME with the DNS Name of the RDS database.)

3. Point PgAdmin to the connection

In PgAdmin, refer to the database as: localhost:5432

You can, of course, use a different port number in the port forwarding connection. This can be useful if forwarding multiple connections to different databases. However, I like to keep them the same if possible.

user_1747770
Related