Amazon RDS and Amazon Virtual Private Cloud (VPC)

Following are the prerequisites for creating a DB Instances within a VPC:

When creating a DB Instance in VPC, you will need to create or select a DB Subnet Group. Amazon RDS uses that DB Subnet Group and your preferred Availability Zone to select a subnet and an IP address within that subnet to associate with your DB Instance.

A DB Subnet Group for a VPC is a collection of subnets (typically private) that you may want to designate for your backend RDS DB Instances. Each DB Subnet Group should have at least one subnet for every Availability Zone in a given Region. When creating a DB Instance in VPC, you will need to select a DB Subnet Group. Amazon RDS uses that DB Subnet Group and your preferred Availability Zone to select a subnet and an IP address within that subnet to associate with your DB Instance.

You must specify a subnet for every Availability Zone while defining a DB Subnet Group. In case the primary DB Instance of a Multi-AZ deployment fails, Amazon RDS can promote the corresponding standby and subsequently create a new standby using an IP address of the subnet in one of the other Availability Zones.

While creating a DB Instance in a VPC, Amazon RDS associates an Elastic Network Interface to your DB Instance using the IP address selected from your DB Subnet Group. However, we strongly recommend you use the DNS Name to connect to your DB Instance as the underlying IP address can change during failover.

When you create a VPC, you can configure it based on the level of privacy you want. In the most private scenario, you can attach only a virtual private gateway, and create an IPsec tunnel between your VPC and home network. In this scenario, your EC2 instances have no direct exposure to the Internet.

You can configure your VPC to be somewhere in between, with both a virtual private gateway and an Internet gateway. Here, some instances could receive Internet traffic (e.g., web servers), whereas others could remain unexposed (e.g., database servers). This is a common scenario for running a multi-tier web application in the AWS cloud.

These different scenarios are discussed in more detail in the Amazon VPC documentation.

You can configure routing in your VPC to control where traffic flows (e.g., to the Internet gateway, virtual private gateway, etc). With an Internet gateway, your VPC has direct access to other AWS products such as Amazon Simple Storage Service (Amazon S3). If you choose to have only a virtual private gateway with a connection to your home network, you can route your Internet-bound traffic over the VPN and control its egress with your security policies and corporate firewall. In the latter case, you incur additional bandwidth charges when accessing AWS products over the Internet.

You can use DB Security Groups, network ACLs, and VPC Security Groups to help secure the instances in your VPC. Security groups act like a firewall at the instance level, whereas network ACLs are an additional layer of security that act at the subnet level.

	Note
	If you associate a VPC to a DB Security Group, all the access rules within that DB Security Group should be either from VPC Security Groups or IP ranges. EC2 Security Groups and VPC Security Groups are not interchangeable.

DB Instances deployed within an Amazon VPC can be accessed by Amazon EC2 Instances deployed in the same VPC. If these EC2 Instances are deployed in a public subnet with associated Elastic IPs, you can access the EC2 Instances via the internet.

	Note
	We strongly recommend you use the DNS Name to connect to your DB Instance as the underlying IP address can change during failovers.

DB Instances deployed within a VPC can be accessed from the Internet or from EC2 Instances outside the VPC via bastion hosts that you can launch in your public subnet or via VPN. You will need to set up a public subnet with an EC2 instance that acts as a SSH Bastion. This public subnet must have an internet gateway and routing rules that allow traffic to be directed via the SSH host, which must then forward requests to the private IP address of your RDS DB instance. You can also set up a VPN Gateway that extends your corporate network into your VPC, and allows access to the RDS DB instance in that VPC.

	Important
	Please refer to the Amazon Virtual Private Cloud documentation for detailed information about Amazon VPC.

For more information on using Amazon RDS with Amazon Virtual Private Cloud, go to Using Amazon RDS with Amazon Virtual Private Cloud (VPC).

Amazon VPC has its own set of documentation to describe how to create and use your VPC. The following table gives links to the Amazon VPC guides.