postgresql - 如何使用 AWS CloudFormation 创建具有公共(public)访问权限的 Postgres 数据库

Question

出于测试目的，我需要创建具有公共(public)访问权限并且可以从任何地方使用的 Postgres 数据库。我当前的 CloudFormation 如下所示:

---
AWSTemplateFormatVersion: "2010-09-09"
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      AvailabilityZone: eu-central-1a

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: true
      AvailabilityZone: eu-central-1b

  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Subnets for RDS database
      SubnetIds:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow all inbound traffic
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 0.0.0.0/0

  DBInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: ourpostgres
      DBName: "database"
      AllocatedStorage: "5"
      DBInstanceClass: db.t3.micro
      Engine: postgres
      VPCSecurityGroups:
        - !Ref SecurityGroup
      DBSubnetGroupName: !Ref DBSubnetGroup
      PubliclyAccessible: true
      MasterUsername: myusername
      MasterUserPassword: mypassword

Outputs:
  DBInstanceEndpoint:
    Description: Endpoint to access the Postgres database
    Value: !GetAtt [DBInstance, Endpoint.Address]

运行此 CloudFormation 数据库实例成功启动后，但我仍然无法从本地计算机登录数据库(使用 Sequel Pro 作为查看器)。我已经尝试设置 VPC、安全组、网关和子网，但似乎仍然缺少一些东西。

您能帮我找出上述 CloudFormation 中的问题吗？

Answer 1

您出现问题的原因是您的子网是私有(private)。

虽然 CloudFormation 模板确实创建了 Internet 网关并将其附加到 VPC，但这两个子网正在使用默认路由表，该路由表不包含到 Internet 网关的路由。因此，子网实际上是私有(private)子网。

您需要更新模板以:

• 创建路由表
• 将 0.0.0.0/0 的流量路由到互联网网关
• 将路由表关联到两个子网

作为示例，这是我从 Building a VPC with CloudFormation - Part 1 获取的一些代码:

  # Some route tables for our subnets:
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Public
  PublicRoute1:   # Public route table has direct routing to IGW:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway  

您需要类似的东西。