Amazon RDS and the Amazon Virtual Private Cloud Service

A DB subnet group is a collection of subnets (typically private) that you create for a VPC and that you then designate for your DB instances. A DB subnet group allows you to specify a particular VPC when creating DB instances using the CLI or API; if you use the console, you can just select the VPC and subnets you want to use.

Each DB subnet group should have subnets in at least two Availability Zones in a given region. When creating a DB instance in VPC, you must select a DB subnet group. Amazon RDS uses that DB subnet group and your preferred Availability Zone to select a subnet and an IP address within that subnet to associate with your DB instance. If the primary DB instance of a Multi-AZ deployment fails, Amazon RDS can promote the corresponding standby and subsequently create a new standby using an IP address of the subnet in one of the other Availability Zones.

When Amazon RDS creates a DB instance in a VPC, it assigns a network interface to your DB instance by using an IP address selected from your DB Subnet Group. However, we strongly recommend that you use the DNS Name to connect to your DB instance because the underlying IP address can change during failover.

When you create a VPC, you can configure the level of privacy that you want. In the most private scenario, you can attach only a virtual private gateway and create an IPsec tunnel between your VPC and your local network. In that case, your instances have no direct exposure to the Internet.

Alternatively, you can configure your VPC with both a virtual private gateway and an Internet gateway. For example, your web servers could receive Internet traffic and your database servers could remain private. This is a common topology for running a multitier web application in the AWS cloud.

For more information about configuring privacy in your VPC, go to the Amazon VPC documentation.

You can configure routing in your VPC to control where traffic flows (for example, to the Internet gateway or to a virtual private gateway). With an Internet gateway, your VPC has direct access to other AWS resources such as Amazon Simple Storage Service (Amazon S3). If you choose to have only a virtual private gateway with a connection to your local network, you can route your Internet-bound traffic over the VPN and control egress with your local security policies and firewall. In that case, you will incur additional bandwidth charges when you access AWS products over the Internet.

You can use DB security groups, network ACLs, and VPC security groups to help secure the instances in your VPC. Security groups act like a firewall at the instance level; network ACLs are an additional layer of security that act at the subnet level.

DB instances that are deployed within an Amazon VPC can be accessed by Amazon EC2 instances that are deployed in the same VPC. If the EC2 instances are deployed in a public subnet with associated Elastic IPs, you can access the EC2 instances via the internet.

DB instances deployed within a VPC can be accessed from the Internet or from EC2 instances outside the VPC. A DB instance is accessible through the IP addresses specified in DB security groups that it is a member of, and through the port specified when the DB instance was created. If a VPC security group specifies a port access such as TPC port 22, you would not be able to access the DB instance because the firewall for the DB instance provides access only via the IP addresses and the port defined when the DB instance was created. For more information on creating a VPC with both public and private subnets, see Scenario 2: VPC with Public and Private Subnets.

For more information about using Amazon RDS with Amazon Virtual Private Cloud, see Using Amazon RDS with Amazon Virtual Private Cloud (VPC).

Amazon VPC has its own set of documentation to describe how to create and use your VPC. The following table gives links to the Amazon VPC guides.