The proper way to secure your databases

Summary

The video presents a high-level guide to securing an AWS RDS PostgreSQL database by keeping it off the public internet and controlling which services can access it.

VPCs and Subnets

A Virtual Private Cloud (VPC) isolates cloud resources within an AWS region. The database is placed in a private subnet, so it has no direct public internet access.

CIDR Blocks

Subnets use CIDR ranges to define their available IP addresses. The speaker illustrates how range size affects the number of possible addresses—for example, a /24 provides a larger range than a /31.

Security Groups

Security groups control access to resources. Rather than exposing the database to arbitrary public IPs, rules can restrict access to approved sources, such as an application’s security group.

Lambda and Internet Access

A Lambda function attached to the VPC can communicate with the private database. If it also needs outbound internet access—for example, to reach an external service—the video describes routing that traffic through a NAT resource in a public subnet.

Database Maintenance Through a Bastion Host

For migrations or other administrative tasks, the speaker describes using an EC2 bastion host and an SSH tunnel. Access can be limited to a trusted IP, such as a developer’s laptop or a CI/CD pipeline, and enabled only when needed.

Multi-Region Networking

VPCs are regional, so a multi-region setup requires a separate VPC in each region. VPC peering can connect VPCs so their resources can communicate, including VPCs in separate AWS accounts. The speaker also notes that database replication across regions may need to be considered.

Logging

Any publicly reachable access point, especially a bastion host, should have strong logging so connections and commands can be investigated.

The video is an educational overview based on the speaker’s recent experience setting up the infrastructure with Terraform. It emphasizes limiting access, avoiding publicly exposed databases, and monitoring administrative access.

Main speaker/source: Web Dev Cody