3

After some reading (AWS docs, http://stratumsecurity.com/2012/12/03/practical-tactical-cloud-security-ec2/, etc..) I still don't understand how to organize secure & easy access to AWS (especially RDS) from users's laptops. For example, my application from dev's laptop should be able to access MySQL RDS.

Is these something I missed? I'm thinking about install OpenVPN on one of EC2 and use it for tunneling all traffic to my AWSs, but probably some better option exists.

TIA, Vitaly

Improve this question
1
  • We use an SSH bastion host to access our instances, which are all in a VPC with no direct access from the public internet.
    – ceejayoz
    Feb 1, 2014 at 21:17

1 Answer 1

Reset to default
2

I still don't understand how to organize secure & easy access to AWS (especially RDS) from users's laptops.

Well, there are many ways to skin this cat, one of which is OpenVPN, as you suggested.

A much more simple option is to just use SSH tunneling. Give your devs shell accounts on an EC2 instance that has access to your RDS. Then they can do something like this from their workstations:

$ ssh -L3600:<fqdn-of-rds-endpoint>:3600 user@your-ec2-host

After doing this, they can connect to their localhost:3600 and traffic will be forwarded all the way through to your RDS instance. Needless to say, you'll need to ensure that your users have appropriate credentials. From RDS's perspective, their traffic will appear to come from your EC2 host.

Improve this answer
1
  • There might be multiple ways to skin it, the question is - what is best practice? Is there any actual research or theory, or do people just make up a method and convince themselves it is fine?
    – frabcus
    May 15, 2018 at 7:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .