VPC和子网是我还是用户？

Question

I am trying to hook up my mobile app to AWS RDS. I want my users to be able to access the Database from anywhere and I want to view my database in SQL Workbench. Are the VPC and Subnet for allowing me access to the database or my users?

Answer 1

Further to the answer by strongjz, I would highly recommend you put your database in a private subnet and prevent any direct connections from the internet.

To connect to it from SQL Workbench you can set up a Bastion server. This is a server that acts as a middleman between the outside internet and your private subnets. There is quite a good tutorial here on how to set one up. They are connecting to Redshift, however the process is exactly the same for connecting to RDS.

To help with the design of the subnet IP ranges, VPC Designer is a good tool for designing the different subnets.

Full disclosure, I am the creator of VPC Designer .

Answer 2

For security reasons and proper Mobile app architecture I would not give the mobile client direct access to the database. Just one compromised machine and your data is gone, corrupted or stolen.

1. Setup an API that the mobile client reach out for data requests.
2. Give only the API access to the Database.
3. Have the mobile client use something like Incognito to access resources.

Here is a reference architecture from AWS for a mobile web app.

Also a paper on how to create a backend for a mobile application

For securely connecting to the database I would use a Software VPN and allow only your IP to connect it and then allow only connections from the Private IP of that VPN to the database. VPC design considerations here . I personally use OpenVPN , it is free for 2 concurrent users minus ec2 time.

As far as VPC subnet design goes, the Database instance should always be placed in private subnets, the api in public subnets exposed with https. AWS cert manager is free to use with ELB/ALB's.