AWS RDS 通過動態 IP 保持用戶訪問

Question

在 AWS rds 上，我添加了一些 postgres 用戶。 有需要 IP 地址才能訪問數據庫實例的Security groups嗎？

因此，如果用戶有 static IP 地址，那么我將添加一次，沒有問題。

但如果用戶有動態地址，我看到的唯一方法是定期更新 IP 以保持用戶有效連接。

我的問題是：是否有可能保持動態 IP 用戶的有效連接，而無需手動更新安全組數據？

謝謝 ！

Answer 1

以下是一些選項；

1. 使用堡壘主機連接 Ec2 。

2. 如果用戶使用固定私有 IP CIDR的辦公網絡/VPN 連接，則允許安全組中的 IP CIDR入站。 注意：* 這可能會打開對您組織更廣泛的專用網絡的訪問。 僅當您從組織私有網絡獲得該 AWS VPC 連接時，RDS 才能在本地使用。

Answer 2

基於@amitd 的回答，您可以並且應該使用堡壘主機，但是您仍然需要將該主機打開到您的動態 IP。 要將僅允許訪問該主機的 IP 地址更新到我分配的 IP 我使用以下腳本

#! /bin/bash

# This script makes it easier to maintain security groups that allow SSH access
# from a computer with a dynamic IP, such as a computer on a home network or ISP.
#
# Using the script will allow you to SSH to an EC2 without having to allow
# access to the whole world (0.0.0.0/0). If you run this script whenever your IP
# changes then the security groups in your account specified by your AWS profile
# will be updated.
#
# The script will find any security groups for your current profile that are
# tagged with a Tag with a Key of "ssh-from-my-ip" and a case insensitive value
# of "true" or "yes".
#
# For each security group found it will revoke any existing tcp ingress on
# port 22 and authorize ingress on port 22 for your current IP.
#
# Dependencies - AWS CLI and jq


# need my current ip
MY_IP=$(curl --silent https://checkip.amazonaws.com)
echo "Your IP is ${MY_IP}"

# need security group id(s) and existing CIDR for the SG
pairs=$(aws ec2 describe-security-groups | aws ec2 describe-security-groups | jq -c '.SecurityGroups[]? | select( (.Tags[]? | select(.Key == "ssh-from-my-ip") | .Value | test("true|yes"; "i"))) | if .IpPermissions | length == 0 then {sg: .GroupId, cidr: null } else {sg: .GroupId, cidr: .IpPermissions[].IpRanges[].CidrIp} end')

for p in $pairs
do
  SG=$(echo "$p" | jq -r '.sg')
  OLD_CIDR=$(echo "$p" | jq -r '.cidr')

  echo "Updating security group ${SG}"
  if [[ $OLD_CIDR != 'null' ]]
  then
    echo "Revoking ingress permission for ${OLD_CIDR} in security group ${SG}"
    # remove the existing ingress permission
    aws ec2 revoke-security-group-ingress \
        --group-id "${SG}" \
        --protocol tcp \
        --port 22 \
        --cidr "${OLD_CIDR}"
  fi

  # authorize my new IP CIDR
  NEW_CIDR="${MY_IP}"/32
  echo "Authorizing ingress permission for ${NEW_CIDR} in security group ${SG}"
  aws ec2 authorize-security-group-ingress --group-id "${SG}" --ip-permissions '[{"IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "IpRanges": [{"CidrIp": "'"${NEW_CIDR}"'", "Description": "Rule0"}]}]'
done