Since AWS' RDS have a firewall based on EC2 security groups (or IP ranges), is it meaningful at all to also restrict connections' origins by restricting users?

  • how did you go with this? do you need further help with this? Commented Aug 22, 2013 at 6:34
  • thanks @DrewKhoury, I think I'm going to follow the safest way and do both
    – Andres
    Commented Aug 29, 2013 at 0:36

1 Answer 1


It's a good idea to do both.

While you might think,

I've secured the stack via AWS security groups, there's no point in doing it again at the application level.

...here are a few things to consider:

  • AWS might experience a bug or vulnerability which permits access where it shouldn't
  • You might accidentally remove or change a security group rule
  • You want broad rules at the security group level, but more specific rules per mysql user

You might consider restricting access at the mysql level overkill, and too much of a maintenance burden. At the end of the day it's up to you decide if the added security is worth the extra work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .