AUDUBON SSH BASTION HOW TO

On the availability zone us-east-2b we have the subnet publicSubnet1B with CIDR 192.168.0.64/27 in the same VPC.Ĭreate a Security Group (Firewall) with the inbound rule to enable MYSQL/Aurora connection through TCP/IP protocol and port 3306 from the security group of Bastion Host. In the Post AWS Network from scratch, we created the privateSubnet1A subnet with CIDR 192.168.0.32/27 on the availability zone us-east-2a and VPC 192.168.0.0/24, the route table, and network access control list (NACL) allows only internal communications. The steps to create an RDS database and deploy it on the private subnet are:Ĭreate a Subnet Group with VPC and at least two Subnetworks in two different availability zones in the AWS region: These keys should be different from the Bastions Host keys to increase the security and reduce the risk to access many infrastructure resources when a third party gets access to the key.Ĭreate an RDS Database on a private Subnet.Īn RDS Database instance is private when it is deployed on a private subnet with communication restrictions from the internet. In the Post AWS Network from scratch, we created the privateSubnet1A subnet with CIDR 192.168.0.32/27 and VPC 192.168.0.0/24, the route table, and network access control list (NACL) allows only internal communications.Ĭreate a Security Group (Firewall) with the inbound rule to enable SSH connection through TCP/IP protocol and port 22 from the security group of Bastion Host.Ĭreate keys (public and private) for SSH authentication. The steps to create an EC2 instance and deploy it on the private subnet are:Ĭhoose VPC and private subnet on EC2 instance detail configuration. Review instance launch details and launch it.Ĭreate an EC2 instance on a private Subnet.Īn EC2 instance is private when it is deployed on a subnet with communication restrictions from the internet. In the Post AWS Network from scratch we created the publicSubnet1A subnet with CIDR 192.168.0.0/27 and VPC 192.168.0.0/24, the route table and network access control list (NACL) allows internal and external communications.Ĭreate a Security Group (Firewall) with the inbound rule to enable SSH connection through TCP/IP protocol and port 22 from our local machine IP address.Ĭreate keys (public and private) for SSH authentication.

Choose AMI (Amazon Machine Image), for this example we use Amazon Linux 2 AMI.Ĭhoose VPC and public subnet on EC2 instance detail configuration. It is an EC2 instance deployed on VPC and public subnet (with access from the internet) for the connection with EC2 instance and RDS databases on VPC and private subnet (without access from the internet) through SSH (Secure Shell) and TCP/IP communication protocols. We start to create an EC2 Bastion Host instance, then provision EC2 and RDS instances on a private subnetwork and establish a connection to these instances through Bastion Hots. We will use the virtual private cloud (VPC) and subnetworks created on the post AWS Networking from scratch to protect the infrastructure by creating private and safe environments with network topologies and access control inbound and outbound communications to EC2 or databases RDS.

AUDUBON SSH BASTION HOW TO

In this post, we are going to see how to establish the connection with EC2 instances and RDS databases that are on private subnetworks (without access from the internet) through Bastion Host or Jump Box and using OpenSSH and MySQL Workbench tools. For doing these activities on EC2 instances and RDS databases are necessary to access securely. As systems administrators, we should keep updating the infrastructure applying security patches, installing the new versions of the operation system, and setting up applications correctly to strengthen the security of cloud technologic resources and achieve AWS Shared Responsibility Model.

Audubon ssh bastion