有没有办法在AWS RDS实例上设置静态IP？

Question

So for a project that I am working on at my office, I have a .NET application that will be storing and retrieving data to/from an AWS RDS MySQL Server that I have setup. The problem that I have run into is that port 3306 is not open on the work network.

I have reached out to my networking department to see what they can do about opening this port. They asked me if there was a way to set a static IP to this AWS RDS Instance. They only want to open the port based on the server's IP address rather than open the port 3306 completely for security reasons they say. After some research, I have seen that it is possible to set an elastic IP (similar to static IP?) on an AWS EC2 instance but I am curious about setting a static IP on an AWS RDS Instance. I did not see anywhere on the AWS Dashboard about setting a static IP for my RDS Instance. The reason behind the static IP is so that when the IP that is associated with the endpoint DNS that they provide changes, they wont need to adjust the firewall settings to accommodate this change.

1. Is it possible to have the port open for only this specific DNS endpoint that AWS provides? If not, is it possible to set an IP to static on the RDS instance?
2. What sort of security concerns are there if they were to completely open port 3306?

Thank you!

Answer 1

You don't need a fixed IP for RDS Instance. When you create a RDS instance AWS service defines a URL for your instance. This URL is fixed. Even in case of IP change the URL will still route to the correct instance.

You can tell your IT team to create a firewall rule in port 3306 for the RDS instance URL and it will work fine.

About the security, the idea is to close the inbound connections on port 3306 to your site. This will restrict anyone trying to connect to your internal instances at the same time that you can connect to all hosts in the internet using this port. There is no need to close all the outbound connections. But...

Is a information security best practice to apply the least privileged access principle. This means: only allow what is specificaly needed. If they open the port for all hosts, maybe in the future, someone can discover a new vulnerability and exploit it, because no one in your IT team will remember why was needed to open the port for all hosts. So.. they keep open only what is needed.