如何识别允许哪些 IP 范围访问 RDS 实例

Question

We have a RDS instance in one of our VPCs. We have 3 private and 3 public subnets within this VPC and the the db instance is attached to all 3 private subnets. We also have 2 separate VPCs where one is connected to the first one via site to site vpn and the other is via a peering connection.

How can I identify the IPs which are allowed to access the RDS instance?

I have to get this information using python boto3. Any idea?

Answer 1

Getting the exact IP-Ranges is a bit tricky, but essentially this is determined by the security groups that are assigned to the DB instance.

Here is a script that lists the inbound rules of all security groups of the DB instance "test-db":

import boto3

def main():
    
    db_instance_identifier = "test-db"

    rds_client = boto3.client("rds")

    db_instances = rds_client.describe_db_instances(
        DBInstanceIdentifier=db_instance_identifier
    )

    # We expect only one result
    db_instance = db_instances["DBInstances"][0]

    # Get a list of the VPC Security Groups
    db_security_group_ids = [
        item["VpcSecurityGroupId"] for item in db_instance["VpcSecurityGroups"]
    ]

    ec2_client = boto3.client("ec2")

    security_groups = ec2_client.describe_security_groups(
        GroupIds=db_security_group_ids
    )

    for security_group in security_groups["SecurityGroups"]:
        for ingress_rule in security_group["IpPermissions"]:
            print(ingress_rule)

if __name__ == "__main__":
    main()

Output

{'FromPort': 22, 'IpProtocol': 'tcp', 'IpRanges': [{'CidrIp': '0.0.0.0/0', 'Description': 'SSH'}], 'Ipv6Ranges': [{'CidrIpv6': '::/0', 'Description': 'SSH'}], 'PrefixListIds': [], 'ToPort': 22, 'UserIdGroupPairs': []}
{'IpProtocol': '-1', 'IpRanges': [], 'Ipv6Ranges': [], 'PrefixListIds': [], 'UserIdGroupPairs': [{'GroupId': 'sg-04dfdddc2792af7e2', 'UserId': '12312313123'}]}
{'FromPort': 80, 'IpProtocol': 'tcp', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}], 'Ipv6Ranges': [{'CidrIpv6': '::/0'}], 'PrefixListIds': [], 'ToPort': 80, 'UserIdGroupPairs': []}
{'FromPort': 5432, 'IpProtocol': 'tcp', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}], 'Ipv6Ranges': [{'CidrIpv6': '::/0'}], 'PrefixListIds': [], 'ToPort': 5432, 'UserIdGroupPairs': []}

Instead of printing the rules, you can do any processing with them that you like. Of course translating security group ids to IP-Ranges is a whole different problem, but given your question I assume your security groups only contain IP ranges.