Secure RDS (private endpoint) and allow connecting from local machine for specific predefined users I'm looking for some way to allow access to RDS (Private endpoint) instances from local machine for a specific set of people (for the internal team.)
ways I know: Create Bastion EC2 and through SSH tunneling connect from local.
as I'm already using k8s from where the instances are reachable. is there any way to do some kind of port forwarding and finally connect RDS instance from local machine?
what I was trying: as I'm already having k8s which has access to those RDS instances, I tried creating a service in that, and through the Loadbalancer, I tried to connect using ssh but failed. (Probably I misunderstood/missing something in the process.)
is there any other secure easy way to do it?
I am not sure it will be helped. I have similar design in my office.
I have some Kubernetes Cluster. all node and master running on local ip from a PVC. And my rds too, only have local ip run on same PVC. Kubernetes Cluster already connect to RDS using local ip.
Then, I build VPN server on bastion server. Have local ip and public ip, run on same PVC with RDS and Kubernetes cluster. So when need connect, I just start my vpn connection on my laptop.
Only vpn/bastion server have IP public. + Load balancer too.
I hope this will give you inspiration.