Security of SQL DB on aws RDS instance having access from any IP address

Question

We have sql db on RDS instance on aws. There is web application hosted on EC2 that has access to sql db. We also access this db from our office. Since we do not have our own static ip for our office, we had to made RDS instance to be accessed from any IP address, so that we can connect to this instance for work. If we had static IP, we would have given access to our IP only.

Question here is how can be make sure that this db is secure & not venerable to security threats? Is there a way we can secure this without purchasing static IP for our office? Apparently, any db which is accessible from any location of the world is open for attacks.
We have spent a week trying to google & find some solution, but no success yet.

Answer 1

Whatever you do, do not expose a production database to the internet "0.0.0.0/0". You're just opening yourself up to data exposure, theft, abuse, etc.

The easiest way to do it is to make your RDS instance "publicly accessible", but from a very short list of fixed IP addresses.

If that won't work for your case, then you can use SSH tunneling to secure your SQL connection. If you must access from "0.0.0.0/0", better SSH than SQL.

Do the following:

1. Put your RDS instance in a private subnet of your VPC. This hides your RDS instance from the internet. In this case, your RDS instance is not publicly accessible.
2. Your web application would access the RDS instance via it's DNS name (which should resolve to it's private IP address).
3. Launch a bastion EC2 instance in a public subnet running sshd.
4. When your users need to access the SQL database from your local network, have them connect to the bastion EC2 instance via SSH and tunnel the SQL connection to the RDS instance through the SSH connection.

Since your web application is accessing the SQL server by private IP address, you won't incur data traffic charges (which you will if you access it by public IP address).

References:

• Creating an SSH port tunnel with PuTTY
• Connect to SQL Server through an SSH tunnel

Answer 2

The easiest and least expensive option for your organization is probably to see if your ISP will give you a static IP address for an extra charge, or find a new ISP that is able to do that.

Otherwise, I'd recommend setting up a VPN between your site and your AWS VPC and connect to the RDS instance over the VPN. This solution depends on having some networking expertise in your organization. This is not a quick and easy fix, unfortunately. Here is a starting point for learning about the different VPN options AWS offers.

Other solutions I've seen are ugly workarounds. Here are two:

• Find out your ISP's CIDR and allow the whole range access. (At least this way you are limiting access to others using your ISP and not the whole internet.)

• Write a script to detect when your ip address changes and update the RDS security group rules with the new ip address.

I assume your ip address changes frequently. (Otherwise, you could just manually update the security group when necessary.... Inconvenient, but more secure than leaving it open to the world.)

If you want to research setting up a VPN, here's a starting point: AWS VPN Connection Options