1

I setup an auto scaling group on EC2 along with an RDS Postgres instance. I am not using ELB. Maybe I should be...

The challenge is that every time a new EC2 instance is created it assigns a unique public IP address. This means that a new inbound rule needs to be applied to the security group for RDS that allows this new EC2 instance to connect to RDS via port 5432 (postgresql).

I also run into a Route 53 issue since the new ip address needs to be added to the DNS "A Record" in order to properly resolve the url.

Is there a way to setup AWS to do this for me, or do I need to write some python code using boto?

11
  • You can authorize the EC2 instances' security group to RDS rather than relying on IP addresses.
    – ceejayoz
    Dec 20 '14 at 2:49
  • Why do you need a DNS record for each EC2 instance? Dec 20 '14 at 21:30
  • @MattHouser So that the URL to the site running on EC2 resolves.
    – nu everest
    Dec 22 '14 at 19:12
  • Why does the URL need to resolve to each instance individually? Dec 22 '14 at 19:34
  • @MattHouser Each instance is running nginx. Doesn't that imply the need for DNS? Is there a better / different way with which I am not familiar?
    – nu everest
    Dec 23 '14 at 14:17
3

This means that a new inbound rule needs to be applied to the security group for RDS that allows this new EC2 instance to connect to RDS via port 5432 (postgresql).

Rather than using public IPs for your security group rules, I suggest using private IPs. Run both EC2 and RDS in the same VPC, then allow the entire VPC subnet IP range containing your EC2 instances in your security group rules for RDS.

I also run into a Route 53 issue since the new ip address needs to be added to the DNS "A Record" in order to properly resolve the url.

You basically have 3 options:

  1. Use ELB
  2. Write a setup script that runs on each instance and updates the DNS automatically
  3. Use OpsWorks which allows you to make a HAProxy instance with an EIP, then automatically adds new application server instances to that HAProxy instance when they start
2

Don't individually add each EC2 instance's IP address to your inbound security group. Instead allow inbound traffic from the security group of the EC2 instances. Then any EC2 instance which uses that security group will be permitted access from the same rule.

Generally speaking, auto-scaling groups are best used behind Elastic Load Balancers if outside access is required. This is because auto-scaling groups are usually used when instances need to start and stop dynamically based on load or other metrics. When a client connects to your group, normally, it shouldn't care which one it actually is connecting to. By assigning individual IP addresses to each instance, the outside world needs to keep track of all these instances.

2
  • "Instead allow inbound traffic from the security group of the EC2 instances." How do I do that on RDS? In the security group I have for my RDS instance (which is different than the security group for my EC2 instance) it only allows me to associate an IP Address with an inbound port.
    – nu everest
    Dec 25 '14 at 17:48
  • 1
    I answered this over here: serverfault.com/questions/655042/… Dec 28 '14 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.