RDS security (encryption, security groups) in AWS - Mini Project: Build & Apply

Secure AWS RDS Instance Setup

📖 Scenario: You are setting up a database for a small web application. To keep the data safe, you need to enable encryption and control which servers can access the database.

🎯 Goal: Create an AWS RDS instance with encryption enabled and configure a security group that allows access only from a specific IP address.

📋 What You'll Learn

Create an RDS instance with storage encryption enabled

Create a security group that allows inbound access on port 3306 only from IP 203.0.113.5/32

Attach the security group to the RDS instance

💡 Why This Matters

🌍 Real World

Securing databases in the cloud is critical to protect sensitive data and comply with security policies. Using encryption and network controls helps prevent unauthorized access.

💼 Career

Cloud engineers and DevOps professionals often configure RDS instances with security best practices to ensure data safety and controlled access.

1

Create the RDS instance resource

Create an AWS RDS instance resource named my_db_instance with engine mysql and instance class db.t3.micro. Set the allocated storage to 20 GB and enable storage encryption by setting storage_encrypted to true.

AWS

# Your code here to create the RDS instance resource

Hint

Use resource "aws_db_instance" "my_db_instance" and set storage_encrypted = true to enable encryption.

2

Create the security group

Create an AWS security group resource named my_db_sg with description Allow MySQL access. Add an ingress rule that allows TCP traffic on port 3306 only from the IP address 203.0.113.5/32.

AWS

resource "aws_db_instance" "my_db_instance" {
  engine             = "mysql"
  instance_class     = "db.t3.micro"
  allocated_storage  = 20
  storage_encrypted  = true
}

# Your code here to create the security group with ingress rule

Hint

Use resource "aws_security_group" "my_db_sg" and add an ingress block with the specified port and IP.

3

Attach the security group to the RDS instance

Add the vpc_security_group_ids attribute to the my_db_instance resource. Set it to a list containing the ID of the security group my_db_sg using aws_security_group.my_db_sg.id.

AWS

resource "aws_db_instance" "my_db_instance" {
  engine             = "mysql"
  instance_class     = "db.t3.micro"
  allocated_storage  = 20
  storage_encrypted  = true

  # Your code here to attach the security group
}

resource "aws_security_group" "my_db_sg" {
  name        = "my_db_sg"
  description = "Allow MySQL access"

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["203.0.113.5/32"]
  }
}

Hint

Inside my_db_instance, add vpc_security_group_ids = [aws_security_group.my_db_sg.id].

4

Add final RDS instance parameters

Add the parameters username set to admin, password set to SecurePass123!, and skip_final_snapshot set to true to the my_db_instance resource.

AWS

resource "aws_db_instance" "my_db_instance" {
  engine             = "mysql"
  instance_class     = "db.t3.micro"
  allocated_storage  = 20
  storage_encrypted  = true
  vpc_security_group_ids = [aws_security_group.my_db_sg.id]

  # Your code here to add username, password, and skip_final_snapshot
}

resource "aws_security_group" "my_db_sg" {
  name        = "my_db_sg"
  description = "Allow MySQL access"

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["203.0.113.5/32"]
  }
}

Hint

Add username = "admin", password = "SecurePass123!", and skip_final_snapshot = true inside the my_db_instance resource.

Practice

1. What does enabling storage_encrypted on an AWS RDS instance do?

easy

A. It encrypts the data stored on the disk to protect it at rest.

B. It encrypts data only during transfer between client and database.

C. It automatically backs up the database to another region.

D. It restricts access to the database based on IP addresses.

Solution

1. Step 1: Understand storage encryption purpose

   Storage encryption protects data saved on disk, making it unreadable without keys.

2. Step 2: Differentiate encryption types

   Encryption at rest means data on disk is encrypted; encryption in transit protects data moving over network.

3. Final Answer:

   It encrypts the data stored on the disk to protect it at rest. -> Option A

4. Quick Check:

   Storage encryption = data safe at rest [OK]

Hint: Storage encryption means data on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking storage_encrypted controls network access
• Assuming it automatically backs up data

2. Which of the following is the correct way to allow inbound traffic on port 3306 (MySQL) in an RDS security group?

easy

A. Allow inbound ICMP traffic on port 3306 from 0.0.0.0/0.

B. Allow outbound UDP traffic on port 3306 to any IP.

C. Allow inbound TCP traffic on port 3306 from the required IP range.

D. Allow inbound TCP traffic on port 22 from the required IP range.

Solution

1. Step 1: Identify correct protocol and port for MySQL

   MySQL uses TCP protocol on port 3306 for inbound connections.

2. Step 2: Confirm security group rule for inbound access

   Security groups must allow inbound TCP traffic on port 3306 from trusted IPs to permit database access.

3. Final Answer:

   Allow inbound TCP traffic on port 3306 from the required IP range. -> Option C

4. Quick Check:

   Inbound TCP 3306 = MySQL access allowed [OK]

Hint: Inbound TCP on port 3306 opens MySQL access [OK]

Common Mistakes:

• Using wrong protocol like UDP or ICMP
• Allowing outbound instead of inbound traffic
• Opening port 22 (SSH) instead of 3306

3. Given this security group rule for an RDS instance:
Inbound: TCP, Port 5432, Source: 192.168.1.0/24
Which client IP can connect successfully?

medium

A. 192.168.1.50

B. 192.168.2.10

C. 10.0.0.5

D. 172.16.0.1

Solution

1. Step 1: Understand CIDR range 192.168.1.0/24

   This range includes all IPs from 192.168.1.0 to 192.168.1.255.

2. Step 2: Check which IP falls inside this range

   192.168.1.50 is inside the range; others are outside.

3. Final Answer:

   192.168.1.50 -> Option A

4. Quick Check:

   192.168.1.0/24 includes 192.168.1.50 [OK]

Hint: Check if IP fits CIDR range to allow connection [OK]

Common Mistakes:

• Not understanding CIDR notation
• Assuming any 192.168.x.x IP is allowed
• Confusing inbound and outbound rules

4. You created an RDS instance with storage_encrypted: true but the console shows encryption as disabled. What is the likely cause?

medium

A. Encryption can only be enabled after instance creation.

B. The security group does not allow inbound traffic on the database port.

C. The IAM role lacks permissions to enable encryption.

D. The RDS instance was created from a snapshot that was not encrypted.

Solution

1. Step 1: Understand encryption behavior on RDS creation

   Encryption must be enabled when creating the instance or from an encrypted snapshot.

2. Step 2: Identify snapshot encryption impact

   If created from an unencrypted snapshot, encryption cannot be enabled later.

3. Final Answer:

   The RDS instance was created from a snapshot that was not encrypted. -> Option D

4. Quick Check:

   Unencrypted snapshot blocks encryption [OK]

Hint: Encryption depends on snapshot encryption at creation [OK]

Common Mistakes:

• Thinking encryption can be toggled anytime
• Confusing security group issues with encryption status
• Assuming IAM permissions control encryption flag

5. You want to secure an RDS instance so only your application servers in a private subnet can connect, and data is encrypted at rest. Which combination is best?

hard

A. Disable encryption and allow inbound from 0.0.0.0/0 for easy access.

B. Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only.

C. Enable encryption but allow inbound from all IPs to avoid connection issues.

D. Use a public subnet for RDS and restrict access by username only.

Solution

1. Step 1: Enable storage encryption for data safety

   Setting storage_encrypted ensures data is encrypted at rest.

2. Step 2: Restrict access via security group to private subnet

   Allowing inbound only from private subnet CIDR limits access to trusted app servers.

3. Final Answer:

   Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only. -> Option B

4. Quick Check:

   Encryption + restricted SG = secure RDS [OK]

Hint: Encrypt data and restrict SG to private subnet [OK]

Common Mistakes:

• Allowing open access (0.0.0.0/0) to RDS
• Disabling encryption for convenience
• Using public subnet exposing RDS to internet