AWS Best Practice: Securely Connecting EC2 to RDS with Security Group Referencing

Hello everyone!

When connecting an EC2 application to an RDS database in AWS, using IP addresses or setting "Public Access" to 'Yes' is highly insecure.

The real, professional-grade solution is to use Security Group Referencing inside a Custom VPC.

In this article, I'll walk you through the exact, secure architecture we just built.

Our Architecture:

1. The Foundation (VPC): A custom private network named my-first-vpc.

2. The Application (EC2): An EC2 instance launched with its own Security Group, my-server-sg, inside my-first-vpc.

3. The Database (RDS): An RDS instance launched with its own separate Security Group, rds-sg, also inside my-first-vpc.

4. The Secure Connection: We tell rds-sg, "You are only allowed to accept traffic that comes from my-server-sg."

---

Step 1: Launch the EC2 Instance & its Security Group

First, let's set up our application server.

1. Go to the EC2 service in the AWS Console - > "Launch instances".

2. In the Network settings section, for VPC, select your custom VPC: my-first-vpc.

3. Subnet: Choose a subnet to place your EC2 instance in (e.g., my-private-app-subnet).

4. Firewall (security groups): Select "Create security group".

   • Security group name: my-server-sg (This is the "badge" for our EC2).

   • Description: SG for my application server.

   • Inbound rules: Add an SSH (Port 22) rule with the source My IP so you can connect to the server for maintenance.

5. Launch the instance.

Now, our EC2 instance exists in my-first-vpc, identified by the my-server-sg group.

---

Step 2: Create a Separate Security Group for RDS

Now, let's create the "gatekeeper" for our database.

1. Go to the VPC service in the AWS Console.

2. On the left menu, select "Security Groups" ->  "Create security group".

3. Security group name: rds-sg

4. Description: SG for the main RDS instance

5. VPC: You must select the exact same VPC: my-first-vpc.

6. Click "Create security group".

---

Step 3: Add the "Magic" Inbound Rule

This is the most important part. We will now teach rds-sg to trust my-server-sg.

1. Find the rds-sg you just created, go to the "Inbound rules" tab -> "Edit inbound rules".

2. Click "Add rule".

   • Type: Select MySQL/Aurora (Port 3306).

   • Source: Choose Custom. In the search box that appears, start typing and select my-server-sg (the Security Group ID of your EC2 instance).

3. Click "Save rules".

Now, rds-sg knows to only open Port 3306 for requests coming from an instance that has the my-server-sg "badge".

---

Step 4: Create the RDS Instance

Finally, let's build the database.

1. Go to the RDS service -> "Create database".

2. Choose your engine, templates, etc.

3. When you get to the Connectivity section:

   • Virtual private cloud (VPC): Select my-first-vpc.

   • Public access: Set to No. (This is critical! It hides the database from the internet).

   • VPC security group (firewall): Select "Choose existing".

   • In the list, remove the default SG (click the 'x') and select your rds-sg.

4. Click "Create database".

The Final Result (What We Built)

You have successfully built:

• An EC2 instance (protected by my-server-sg).

• An RDS database (protected by rds-sg).

• ...all living inside the same private my-first-vpc network.

The rds-sg only trusts my-server-sg. This means only your application can talk to your database. This entire connection happens over private IPs within AWS, never touching the public internet.

This is the most secure and recommended way to build applications on AWS!