If your MySQL instance is running on the same instance and is only answering local connections, then you don't need any entries for port 3306 at all in your security group config.
Also, for defence in depth, you should set the
bind-address MySQL configuration directive to
127.0.0.1 (probably the default, but worth checking).
You've two routes for opening up access from outside:
bind-address back to
0.0.0.0, and add
a.b.c.d/32 to your security group (whatever that IP might be) to allow access on port 3306. However, this is a basic method that transmits in plaintext.
- Use SSH port forwarding. Logging in to your shell with
ssh -L33306:127.0.0.1:3306 user@host will let you then launch
mysql -h localhost -P 33306 on your local machine to connect through the tunnel.
-bind-address doesn't need to be opened up in this case, since the mysql connection is still local (the local port can be whatever you like so long as the
-P arguments match) . This will give you a more secure route in, and you can configure SSH to use private keys, for added protection.