Connecting AWS Lambda and RDS in different AWS Accounts

user_11308443 0
Viewed 2171

We have multiple AWS accounts for various departments. I want to give a Lambda function in one account access to an RDS instance in another.

If the Lambda function is not assigned to a VPC and the RDS is publicly accessible is there a way to limit the access to the RDS to only the Lambda function?

Is there a way to do this if the RDS instance is private and the Lambda function is not assigned to a VPC?

aws-lambda amazon-rds amazon-web-services
2 Answers

As best practice you should always keep your db in private subnet WITHOUT public ip and access. And then in your case assume all your AWS accounts are in a single organisation, you can share the subnets that the RDS located in account A to account B by https://aws.amazon.com/premiumsupport/knowledge-center/vpc-share-subnet-with-another-account/

Then in account B you config the Lambda to sit in the shared subnets from A, and set security group of Lambda functions, and in RDS instance security group you only allow connection from Lambda's security group, then all set.

May I know why you don't want to put Lambda into VPC? If you have concerns on Lambda cold start performance issue in VPC, notice that AWS already solve that in late 2019: https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/

user_164201690

Public Amazon RDS database

If the Lambda function is not assigned to a VPC, then it is connected to the Internet. It can then connect to a publicly-available RDS database. However, there is no way to predict the IP address that will be used by the Lambda function.

Private Amazon RDS database

If the RDS database is only available within a VPC, then the Lambda function needs to be somehow connected to the VPC. Since the Lambda function is in a different AWS Account, you might be able to try:

  • VPC Peering to make the RDS database in one account accessible to the Lambda function in a different account
  • Shared VPCs: "In a shared VPC, each participant pays for their application resources including Amazon EC2 instances, Amazon Relational Database Service databases, Amazon Redshift clusters, and AWS Lambda functions."

The Shared VPC looks like it might be a great option for you, since (it seems) the AWS Lambda function from Account A could be placed into the same VPC as an Amazon RDS database from Account B.

See also: VPC sharing: A new approach to multiple accounts and VPC management | Networking & Content Delivery

Let us know if it worked for you!

user_1747770
Related