How Do I Create an EC2 Security Group for Your RDS Instances?

Introduction

In this solution, we will create an EC2 security group for RDS instances using Pulumi in TypeScript. The security group will have ingress rules to allow TCP traffic on port 3306 for MySQL/MariaDB or port 5432 for PostgreSQL. The source of the traffic will be an application security group, and access to the instance from the internet will be restricted. This security group will be referred to as the database security group.

Step-by-Step Explanation

Step 1: Create the Database Security Group

We will start by creating the EC2 security group for the RDS instances. This security group will be used to control access to the database instances.

Step 2: Add Ingress Rules

Next, we will add ingress rules to the security group to allow TCP traffic on the required ports (3306 for MySQL/MariaDB or 5432 for PostgreSQL). The source of the traffic will be the application security group.

Step 3: Restrict Access from the Internet

Finally, we will ensure that access to the database instances is restricted from the internet by not adding any ingress rules that allow traffic from the internet.

Key Points

• We are using Pulumi in TypeScript to create and manage the EC2 security group for RDS instances.
• The security group will have ingress rules to allow TCP traffic on port 3306 for MySQL/MariaDB or port 5432 for PostgreSQL.
• The source of the traffic will be the application security group.
• Access to the database instances from the internet will be restricted.

Conclusion

By following this solution, we have successfully created an EC2 security group for RDS instances using Pulumi in TypeScript. The security group has the necessary ingress rules to allow traffic from the application security group on the required ports, and access from the internet is restricted. This ensures that our database instances are secure and only accessible from the application security group.

Full Code Example

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an EC2 security group for the application
const appSecurityGroup = new aws.ec2.SecurityGroup("appSecurityGroup", {
    description: "Security group for application servers",
    vpcId: "vpc-12345678", // Replace with your VPC ID
});

// Create an EC2 security group for the RDS instances
const dbSecurityGroup = new aws.ec2.SecurityGroup("dbSecurityGroup", {
    description: "Security group for RDS instances",
    vpcId: "vpc-12345678", // Replace with your VPC ID
});

// Add ingress rule to allow MySQL/MariaDB traffic from the application security group
const dbIngressMySQL = new aws.ec2.SecurityGroupRule("dbIngressMySQL", {
    type: "ingress",
    fromPort: 3306,
    toPort: 3306,
    protocol: "tcp",
    securityGroupId: dbSecurityGroup.id,
    sourceSecurityGroupId: appSecurityGroup.id,
});

// Add ingress rule to allow PostgreSQL traffic from the application security group
const dbIngressPostgreSQL = new aws.ec2.SecurityGroupRule("dbIngressPostgreSQL", {
    type: "ingress",
    fromPort: 5432,
    toPort: 5432,
    protocol: "tcp",
    securityGroupId: dbSecurityGroup.id,
    sourceSecurityGroupId: appSecurityGroup.id,
});

// Export the security group IDs
export const appSecurityGroupId = appSecurityGroup.id;
export const dbSecurityGroupId = dbSecurityGroup.id;