To connect to a private RDS DB instance from a local machine using an EC2 instance as a jump server, follow these steps:
- Launch and configure your EC2 instance and configure the network setting of the instance.
- Configure the RDS DB instance's security groups.
- Connect to the RDS DB instance from your local machine.
Launch and configure the EC2 instance
- Open the Amazon EC2 console, and choose Launch instance.
- Select an Amazon Machine Image (AMI).
- Choose an instance type, and then choose Next: Configure Instance Details.
- For Network, choose the VPC that the RDS DB instance uses.
- For Subnet, select the subnet that has an internet gateway in its routing table. If you don't already have an internet gateway, you can add it to the subnet after the EC2 instance is created.
- Choose Next: Add Storage, and modify storage as needed.
- Choose Next: Add Tags, and add tags as needed.
- Choose Next: Configure Security Group, choose Add Rule, and enter the following:
Type: Custom TCP Rule
Protocol: TCP
Port Range: 22
Source: Enter the IP address of your local machine. By default, the source IP address is open to all. But you can restrict access to your local public IP address only. - Choose Review and Launch.
- Choose Launch.
Configure the RDS DB instance's security groups
- Open the Amazon RDS console, and choose Databases from the navigation pane.
- Choose the name of the RDS DB instance. Or create an RDS DB instance, if you don't already have one.
- Choose the Connectivity & security tab.
- From the Security section, choose the link under VPC security groups.
- Select the security group, choose Actions, and choose Edit inbound rules.
- Choose Add rule and enter the following:
Type: Custom TCP Rule
Protocol: TCP
Port Range: Enter the port of your RDS DB instance
Source: Enter the private IP address of your EC2 instance - Choose Save.
This configuration for the security group allows traffic from the EC2 instance's private IP address. If the EC2 instance and the RDS DB instance use the same VPC, then you don't need to modify the route table that is used by the RDS DB instance. If the VPC is different, then create a VPC peering connection to allow connections between those VPCs.