Why do hostnames of connections to Aurora Serverless come from outside the VPC?

user_1951414 0
Viewed 419

I have a php website running in Beanstalk behind a load balancer.

The website is connecting to a MySQL compatible database running as Aurora Serverless.

Both the elastic beanstalk instance and Aurora is set up in the same VPC.

The VPC CIDR is 10.10.0.0/24
The elastic beanstalk instance has local IP 10.10.0.18

The serverless Aurora cluster is using VPC endpoints in the two subnets of the VPC and their IP addresses are 10.10.0.30 and 10.10.0.75.

Even though Aurora Serverless is limited to only accepting connections from within the VPC, out of habit I have still only granted my user permission if they are coming from the VPC.
So for instance I have granted permissions to 'user'@'10.10.0.%'

When my website tries to connect to the database however it gets permission denied because it is trying to access it with a user that was not granted permission because the host is not in the 10.10.0.0/24 subnet.

Here are some of the errors that I am getting:

  • Access denied for user 'user'@'10.1.17.79' (using password: YES)
  • Access denied for user 'user'@'10.1.18.17' (using password: YES)
  • Access denied for user 'user'@'10.1.19.1' (using password: YES)
  • Access denied for user 'user'@'10.1.19.177' (using password: YES)

As you can see, none of those hosts are within my VPC.

Is this because the cluster is running in its own VPC, linked to mine via the private links?

And if so, are my only option to use % as the host for users I grant privileges?

Personally I would like to have locked it down to only my VPC just in case Serverless Aurora opens up for connections from the internet in the future.

aws-aurora-serverless amazon-aurora amazon-web-services
1 Answers

Don't whitelist to any specific IP addresses like that for RDS. Especially with Aurora serverless where the node IPs can change at a moments notice a it scales you will find there is no way to know the true IP address of the node.

Remember that all the RDS database services technically run within a AWS managed VPC, you do however get an ENI attached to your VPC that allows you to connect to the instance. This allows you to communicate as if the resource is actually created within your VPC.

The best way to enhance security is going to be through security groups and NACLs, combined with using TLS and encryption at rest. Finally ensure your passwords are strong and rotated frequently.

The RDS Best Practices should help you to dive into other practices you can follow to enhance your security.

user_134609330
Related