Connecting to RDS? Say Goodbye to Bastion Hosts – Secure, Simple and Cost-Effective Access with AWS SSM

Overview

Traditionally, accessing AWS RDS instances in private subnets required a bastion host in a public subnet and SSH keys for secure access. With AWS Systems Manager (SSM) and AWS CLI, you can simplify this process and securely access RDS instances without the need for a bastion host or SSH keys.

Prerequisites

To follow this guide, ensure you have:

• AWS CLI: Installed on your local machine.
• IAM Permissions: The EC2 instance (serving as a jump host) requires permissions for SSM and EC2 services.

SSM Agent: Installed and running on the EC2 instance.Note: The SSM Agent is pre-installed on most Amazon Machine Images (AMIs). For custom AMIs, manual installation may be necessary.

Install AWS CLI

On Windows: Download and install the AWS CLI from the official AWS CLI download page.

On macOS:

brew install awscli

On Linux:

sudo apt-get update
sudo apt-get install
awscli -y        

Verify the Installation: Verify the Installation: Run the following command to confirm the AWS CLI version is installed correctly.

aws --version

Configure AWS CLI

To set up the AWS CLI, you'll need your AWS Access Key ID, Secret Access Key, default region, and output format.

Run the following command:

aws configure

When prompted, enter the following details:

• AWS Access Key ID and Secret Access Key: Generate these in the IAM console if needed.
• Default Region: Enter the region where your RDS instance and jump host are located.
• Default Output Format: Choose json, text, or table based on your preference.

Expand Image

Install Session Manager Plugin

• Download and install the AWS Session Manager plugin for the CLI from the official AWS Systems Manager page. Verify the installation using the command:

session-manager-plugin --version       

Attach Role to EC2 Instance

Create an IAM Role in AWS Console

• Log in to AWS, navigate to the IAM service, select 'Roles,' and click 'Create Role' :

Expand Image

• Choose AWS Service as the trusted entity and EC2 as the use case :

Expand Image

• In Permissions Policies, select AmazonSSMManagedInstanceCore and click Next :

Expand Image

• Name the role (e.g., EC2_SSM_ROLE) and create it :

Expand Image

Launch an EC2 Instance and Attach the IAM Role

• Provide a name for the instance :

Expand Image

• Retain default settings and proceed to the Key Pair section. Choose 'Proceed without a key pair' :

Expand Image

• In Network settings, select your VPC, subnet, and security group :

Expand Image

Note: Ensure your VPC has a NAT Gateway if you're selecting a private subnet for AWS Systems Manager (SSM) connectivity. Without a NAT Gateway, opt for a public subnet to ensure internet access for the EC2 instance.

• In Advanced details, select the IAM instance profile (EC2_SSM_ROLE) created earlier, then launch the instance :

Expand Image

Start an SSM Port Forwarding Session

To begin an SSM port forwarding session, use the command below:

Expand Image

Note : Substitute instance-id and rds-endpoint with your EC2 instance ID and the endpoint of your RDS database respectively.

Example Commands:

• PostgreSQL Database:

Expand Image

• MySQL Database:

Expand Image

• Accessing the DB : After running the command, you can connect to your RDS database using localhost:5432 (or the specified local port).

Expand Image

Verifying Connectivity with DBeaver:

• Download DBeaver from here.
• Open DBeaver and select your database type (e.g., PostgreSQL).

Expand Image

• Enter your database name, username, and password.

Expand Image

• Click Test Connection to confirm connectivity, then select Finish to establish the connection.

Expand Image

Note: Even though this setup connects directly to the AWS RDS database without needing a bastion host, an EC2 instance (or other compute resources like ECS or EKS) within the same VPC as the RDS instance is still required for connectivity. However, you don't need to create a separate EC2 instance just for database access. Any EC2 instance, ECS worker, or EKS node within the VPC can be used to connect to the RDS database, ensuring a streamlined and efficient setup.

Conclusion

In this guide, we explored a secure and streamlined approach to accessing AWS RDS instances in private subnets using AWS Systems Manager (SSM) and the AWS CLI. By eliminating the need for traditional bastion hosts and SSH keys, this method simplifies infrastructure management while enhancing security.

With SSM port forwarding, you can securely connect to your RDS database without exposing sensitive credentials or managing intermediary hosts. Additionally, leveraging IAM roles ensures proper access control and follows AWS best practices for least privilege.

As organizations continue to prioritize cloud security and operational efficiency, adopting tools like AWS Systems Manager becomes essential. Whether you're managing databases in production or accessing instances in development environments, this method offers a scalable and secure solution.