I have hosted an AWS RDS inside the private subnet of the VPC. While creating the VPC with public and private subnets, I had to create a NAT instance. I know NAT instance is mainly for private instances to connect to the internet.

Is the NAT instance necessary for RDS also? Are the RDS' maintenance and update also goes through the NAT instance? I only have the RDS in private subnet, all other EC2 instances are in public subnets. If RDS is not using the NAT instance, I can go ahead and stop the instance, right?

Any help will be appreciated.

1 Answer 1


General Rule

NAT provides outgoing internet access, and does not allow incoming connections. Note that NAT gateway is a managed service, and is generally preferred over a NAT instance.

RDS does not need to initiate connections to the internet, so it does not need access to a NAT instance / gateway. RDS is fully managed by AWS, including software updates of database that runs RDS (MySQL, PostgreSQL, etc).

RDS Replication

With database replication internet ingress is required, but that isn't provided by NAT.

RDS Exposed to the Internet

You can expose an RDS instance to the internet (aka "make it publicly accessible"), but that's incoming rather than outgoing so NAT isn't required.

  • 2
    What about RDS update, doesn't it need an internet connection? For that, how is it going to connect to the internet? Dec 4, 2018 at 1:05
  • 3
    @NeronJoseph the RDS service handles patching. No Internet access is required. Dec 4, 2018 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.