An RDS Security Group is a set of rules that control inbound and outbound traffic to an Amazon RDS instance. It acts as a virtual firewall, defining which IP addresses, instances, or networks can connect to the database.
Types of Security Groups in Amazon RDS :
Amazon RDS supports two types of security groups, depending on whether the database runs in EC2-Classic or Amazon VPC:
-
VPC Security Groups (Recommended)
- Used when RDS is launched inside a Virtual Private Cloud (VPC).
- Allows inbound/outbound traffic control based on IP addresses or EC2 instances.
- Supports both public and private RDS instances.
-
EC2-Classic Security Groups (Legacy)
- Used in older AWS accounts running EC2-Classic mode (before 2013).
- Controls access to RDS instances that are not inside a VPC.
- No longer recommended; AWS encourages migration to VPC-based RDS instances.
How RDS Security Groups Work :
- Security groups contain inbound rules that specify which sources can connect to the RDS instance.
- By default, all inbound traffic is denied unless explicitly allowed.
- Outbound rules allow traffic to leave the RDS instance (typically unrestricted for database access).
Key Features of RDS Security Groups :
* IP-Based Access Control – Restrict access to specific IP addresses (e.g., office network).
* Instance-Based Access – Allow connections only from specific EC2 instances or AWS services.
* Multiple Rules – Define multiple rules to grant access to different users, applications, or services.
* Dynamic Updates – Changes to security groups apply instantly without restarting the database.
* Cross-Region Support – Security groups can be configured for multi-region deployments.
Configuring an RDS Security Group :
-
Go to the AWS Management Console
- Navigate to EC2 > Security Groups or RDS > Databases > Security Groups.
-
Create a New Security Group
- Choose VPC-based security group if the RDS instance is inside a VPC.
-
Add Inbound Rules
- Allow specific IP addresses, EC2 instances, or AWS services to connect.
- Example: Allow access from 192.168.1.100/32 (office network) or EC2 instance security group.
-
Apply the Security Group to the RDS Instance
- Modify the RDS instance settings and attach the security group.
-
Test the Connection
- Use a database client (e.g., MySQL Workbench, pgAdmin) to connect and verify access.
