0

Let's suppose I have a ALB and a couple of EC2 instances (in auto scaling) spread over 3 AZs. And I also have a MultiAZ RDS instance with a few read replicas also spread across the same 3 AZs.

My question now is, how do I prevent my EC2 instances in one AZ from connecting to replicas in a different AZ while still maintaining failover and requiring minimal manual configuration. Assume I have a private Route53 zone that contains CNAME records (simple routing) pointing to my RDS instances if that makes things easier.

This is primarily to reduce connection latency and save on cost since AWS does charge for cross AZ traffic.

1 Answer 1

1

Given your AZs have a distinctive private IP range, you can create a Security Group that you can assign to your services in the AZ that blocks traffic from your other AZ private ranges.

2
  • But wouldn't that make the services waste a bunch of time when they try to connect? Since security groups drop traffic instead of rejecting it. So the services will wait till timeout before trying the next resource.
    – Trinopoty
    Apr 26, 2021 at 3:05
  • That wasn't the question. :) I guess the DROP rule would only matter when the application starts up and you can reduce the connection timeout to something sensible, e.g. 2 secs. Plan B could be to adjust the VPC's Route Tables, create a route table for the EC2s in each AZ and remove routing to the other AZs.
    – aries1980
    May 1, 2021 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .