限制对跨区域EC2实例亚马逊的访问

Question

I need to design a cross-region cross-VPC architecture and i am not sure how i can restrict access to my resources The requirement is that i need to run my web app in one region and my database in an another region. Both the servers are inside private subnets. The web app has an auto scaling group and load balancer attached. The database server in the other region should only be accessible from this web app. I cannot use ip based restrictions as the IP of load balancer changes with time. What other option do i have?

Answer 1

The IP address of your Load Balancer is irrelevant because the Load Balancer is only used for incoming connections to your web server.

First, I should point out that having your database remote from your application is a poor architectural decision , which will slow down your application. Please reconsider it if possible!

You have not provided much information, so I will make the following assumptions:

• VPC in Region A contains:
  • A Load Balancer in a public subnet
  • Web servers in a private subnet
• VPC in Region B contains:
  • A database in a private subnet

In this situation, you wish to communicate between two private subnets in different VPCs that reside in different regions. For this, you could consider creating a private VPN connection via Amazon EC2 instances located in the public subnets of each VPC. This would use a software VPN such as OpenVPN or OpenSwan .

You should also consider how to achieve a High Availability option for this solution. A well-architected VPC would have your web servers deployed across multiple Availability Zones in Region A, with your database preferably in a multi-AZ configuration in Region B (assuming that you are using Amazon RDS). You should similarly design your VPN solution to be highly-available in case of failure.

An alternative is to put a NAT Server in the public subnet of the VPC in Region A and configure the private Route Table to send traffic through the NAT Server. This means that traffic going from the web servers to the Internet would all come from the public IP address associate with the NAT Server ( not the Load Balancer).

However, the database is in a private subnet, so the traffic cannot be directly routed to the database so this is only half a solution. It would then either require the database to be in a public subnet (with a Security Group that only accepts connections from the NAT Server) or some type of proxy server in the public subnet that would forward traffic to the database. This would become way too complex compared to the Software VPN option.