amazon-web-services - 无法连接到 VPC 中的 MariaDB RDS 实例

Question

我构建了一个 VPC，其中包含一些 AWS 资源。我在VPC内就可以访问Internet，并且VPC内的资源可以互相通信。例如，我有一个 Lambda 函数，它可以与 Internet 通信，也可以访问 VPC 内的 RDS 实例。但是，当我尝试从本地计算机连接到 RDS 实例时，问题就出现了。

我已尝试更新 VPCSecurityGroup 以允许所有传入流量，但仍然不起作用。唯一可行的办法是，如果我将所有路由表切换为使用 IGW 而不是 NAT，但我更希望情况并非如此。另外，我什至不确定我是否可以这样做，因为我很确定 lambda 函数必须存在于私有(private)子网中。

vpc.yml

AWSTemplateFormatVersion: 2010-09-09
Description: VPC Stack
Resources:
  Vpc:
    Type: 'AWS::EC2::VPC'
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default    
  InternetGateway:
    Type: 'AWS::EC2::InternetGateway'
  VpcGatewayAttachment:
    Type: 'AWS::EC2::VPCGatewayAttachment'
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref InternetGateway
  ElasticIP:
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc
  NatGateway:
    Type: 'AWS::EC2::NatGateway'
    DependsOn:
      - VpcGatewayAttachment
    Properties:
      AllocationId: !GetAtt 
        - ElasticIP
        - AllocationId
      SubnetId: !Ref SubnetAPublic
  SubnetAPublic:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select 
        - '0'
        - !GetAZs ''
      CidrBlock: 10.0.0.0/19
      MapPublicIpOnLaunch: true
      VpcId: !Ref Vpc
  SubnetBPublic:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select 
        - '1'
        - !GetAZs ''
      CidrBlock: 10.0.32.0/19
      MapPublicIpOnLaunch: true
      VpcId: !Ref Vpc
  SubnetAPrivate:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select 
        - '0'
        - !GetAZs ''
      CidrBlock: 10.0.64.0/19
      VpcId: !Ref Vpc
  SubnetBPrivate:
    Type: 'AWS::EC2::Subnet'
    Properties:
      AvailabilityZone: !Select 
        - '1'
        - !GetAZs ''
      CidrBlock: 10.0.96.0/19
      VpcId: !Ref Vpc
  RouteTableAPublic:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
  RouteTableBPublic:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
  RouteTableAPrivate:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
  RouteTableBPrivate:
    Type: 'AWS::EC2::RouteTable'
    Properties:
      VpcId: !Ref Vpc
  RouteTableAssociationAPublic:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetAPublic
      RouteTableId: !Ref RouteTableAPublic
  RouteTableAssociationBPublic:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetBPublic
      RouteTableId: !Ref RouteTableBPublic
  RouteTableAssociationAPrivate:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetAPrivate
      RouteTableId: !Ref RouteTableAPrivate
  RouteTableAssociationBPrivate:
    Type: 'AWS::EC2::SubnetRouteTableAssociation'
    Properties:
      SubnetId: !Ref SubnetBPrivate
      RouteTableId: !Ref RouteTableBPrivate
  RouteTableAPrivateInternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn:
      - VpcGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTableAPrivate
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway
  RouteTableBPrivateInternetRoute:
    Type: 'AWS::EC2::Route'
    DependsOn:
      - VpcGatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTableBPrivate
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway
  RouteTableAPublicInternetRoute:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref RouteTableAPublic
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  RouteTableBPublicInternetRoute:
    Type: 'AWS::EC2::Route'
    Properties:
      RouteTableId: !Ref RouteTableBPublic
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  NetworkAclPublic:
    Type: 'AWS::EC2::NetworkAcl'
    Properties:
      VpcId: !Ref Vpc
  NetworkAclPrivate:
    Type: 'AWS::EC2::NetworkAcl'
    Properties:
      VpcId: !Ref Vpc
  SubnetNetworkAclAssociationAPublic:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetAPublic
      NetworkAclId: !Ref NetworkAclPublic
  SubnetNetworkAclAssociationBPublic:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetBPublic
      NetworkAclId: !Ref NetworkAclPublic
  SubnetNetworkAclAssociationAPrivate:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetAPrivate
      NetworkAclId: !Ref NetworkAclPrivate
  SubnetNetworkAclAssociationBPrivate:
    Type: 'AWS::EC2::SubnetNetworkAclAssociation'
    Properties:
      SubnetId: !Ref SubnetBPrivate
      NetworkAclId: !Ref NetworkAclPrivate
  NetworkAclEntryInPublicAllowAll:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPublic
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: 0.0.0.0/0
  NetworkAclEntryOutPublicAllowAll:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPublic
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: 0.0.0.0/0
  NetworkAclEntryInPrivateAllowVpc:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPrivate
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: 0.0.0.0/0
  NetworkAclEntryOutPrivateAllowVpc:
    Type: 'AWS::EC2::NetworkAclEntry'
    Properties:
      NetworkAclId: !Ref NetworkAclPrivate
      RuleNumber: 99
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: 0.0.0.0/0
  LambdaSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Lambdas security group
      SecurityGroupEgress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: '-1'
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: '-1'
      VpcId: !Ref Vpc
Outputs:
  VpcId:
    Description: VPC ID
    Value: !Ref Vpc
    Export:
      Name: !Sub "Portal-VpcId"
  SubnetAPrivate:
    Description: Subnet A Private
    Value: !Ref SubnetAPrivate
    Export:
      Name: !Sub "SubnetAPrivate"
  SubnetBPrivate:
    Description: Subnet B Private
    Value: !Ref SubnetBPrivate
    Export:
      Name: !Sub "SubnetBPrivate"     
  SubnetAPublic:
    Description: Subnet A Public
    Value: !Ref SubnetAPublic
    Export:
      Name: !Sub "SubnetAPublic"
  SubnetBPublic:
    Description: Subnet B Public
    Value: !Ref SubnetBPublic
    Export:
      Name: !Sub "SubnetBPublic"  
  LambdaSecurityGroup:
    Description: Access to Lambda functions
    Value: !Ref LambdaSecurityGroup
    Export:
      Name: !Sub "LambdaSecurityGroup"

rds.yml

DBSubnetGroup:
    Type: 'AWS::RDS::DBSubnetGroup'
    Properties:
      DBSubnetGroupDescription: Subnets available for the RDS DB Instance
      SubnetIds: 
        - !Ref SubnetAPublic
        - !Ref SubnetBPublic
  VPCSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Security group for RDS DB Instance.
      VpcId: !Ref VpcId
      SecurityGroupIngress: 
        - 
          IpProtocol: "tcp"
          FromPort: "3306"
          ToPort: "3306"
          CidrIp: "[my IP]"
        - 
          IpProtocol: "tcp"
          FromPort: "3306"
          ToPort: "3306"
          CidrIp: "10.0.64.0/19"
        - 
          IpProtocol: "tcp"
          FromPort: "3306"
          ToPort: "3306"
          CidrIp: "10.0.96.0/19"
  DBInstance:
    Type: 'AWS::RDS::DBInstance'
    Properties:
      DBName: !Join
        - ''
        - - portal
          - !Ref Environment
      AllocatedStorage: !Ref DBAllocatedStorage
      DBInstanceClass: !Ref DBClass
      Engine: MariaDB
      EngineVersion: '10.1.23'
      MasterUsername: !Ref DBUsername
      MasterUserPassword: !Ref DBPassword
      DBSubnetGroupName: !Ref DBSubnetGroup
      StorageEncrypted: true
      PubliclyAccessible: true
      VPCSecurityGroups:
        - !Ref VPCSecurityGroup
  DatabaseDnsRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: !Join 
        - ''
        - - !Ref HostedZoneName
          - .
      Name: !Join
      - ''
      - - portal
        - !Ref Environment
        - 'db'
        - .
        - !Ref HostedZoneName
        - .
      Type: CNAME
      TTL: '60'
      ResourceRecords: 
        - !GetAtt 
          - DBInstance
          - Endpoint.Address
    DependsOn: DBInstance

Answer 1

你的问题是这样的

The only thing that seems to work is if I switch all of the Route Tables to use an IGW as opposed to a NAT

您的实例位于私有(private)子网中，无法从公共(public) Internet(您的家庭 PC)访问这些子网。您有三个(或更多)解决方案:

1) 将您的实例移至公有子网。不推荐。

2) 将您的私有(private)子网转换为公有子网(从 NAT 切换到 IGW)。不推荐。

3) 创建从您的家庭网络到位于公有子网中的新 EC2 实例的 VPN，该实例将您的流量路由到私有(private)子网中的实例。 推荐。

OpenVPN 是一个非常酷的解决方案。您可以自己构建它，也可以从 Amazon Marketplace 免费启动 OpenVPN 实例(我认为免费仅限 2 个用户)。 OpenVPN Access Server

OpenVPN 访问服务器运行时将会产生 EC2 实例费用。我所做的就是在不需要该实例时关闭该实例，并在使用批处理文件中存储的 AWS CLI 命令时重新启动它。