1

I have hosted an AWS RDS inside the private subnet of the VPC. While creating the VPC with public and private subnets, I had to create a NAT instance. I know NAT instance is mainly for private instances to connect to the internet.

Is the NAT instance necessary for RDS also? Are the RDS' maintenance and update also goes through the NAT instance? I only have the RDS in private subnet, all other EC2 instances are in public subnets. If RDS is not using the NAT instance, I can go ahead and stop the instance, right?

Any help will be appreciated.

4

General Rule

NAT provides outgoing internet access, and does not allow incoming connections. Note that NAT gateway is a managed service, and is generally preferred over a NAT instance.

RDS does not need to initiate connections to the internet, so it does not need access to a NAT instance / gateway. RDS is fully managed by AWS, including software updates of database that runs RDS (MySQL, PostgreSQL, etc).

RDS Replication

With database replication internet ingress is required, but that isn't provided by NAT.

RDS Exposed to the Internet

You can expose an RDS instance to the internet (aka "make it publicly accessible"), but that's incoming rather than outgoing so NAT isn't required.

  • What about RDS update, doesn't it need an internet connection? For that, how is it going to connect to the internet? – Neron Joseph Dec 4 '18 at 1:05
  • 1
    @NeronJoseph the RDS service handles patching. No Internet access is required. – Michael - sqlbot Dec 4 '18 at 1:34

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.