Access a Private AWS RDS Database Securely Using a Bastion Host and Session Manager | Complete Demo
In this video, you’ll learn how to securely access a private AWS RDS PostgreSQL database from your local machine without enabling public access. I walk through using a Bastion Host (Jump Box) combined with AWS Systems Manager Session Manager to establish a secure tunnel into a private RDS instance, and then connect to it using pgAdmin. This approach follows AWS security best practices by: Keeping your RDS database fully private Avoiding SSH key management Eliminating inbound security group rules Leveraging IAM-based access via Session Manager What you’ll learn: How a Bastion Host works in a private VPC Configuring AWS Systems Manager Session Manager Creating a secure port-forwarding session Connecting pgAdmin to a private RDS PostgreSQL database Common pitfalls and troubleshooting tips This setup is ideal for DevOps engineers, cloud engineers, and backend developers who need secure database access in AWS without exposing infrastructure to the public internet. Installations and connecting to your database from your EC2 instance 1.Installs PostgreSQL version 15 client command: sudo dnf install -y postgresql15 2. Connect to a remote database psql -h host -p port -U username -d database Common parameters -h – Database host (DNS name or IP). host - database endpoint -p – Port number (default is 5432). -U – PostgreSQL role (user). -d – Database name. example psql -h database-1-instance-1.c4xgm0ct6ev4.eu-west-1.rds.amazonaws.com -p 5432 -U dan -d postgres Installing session manager plugin on your local machine use the url below : install session manager plugin first https://s3.amazonaws.com/session-mana... 2.connecting via session manager aws ssm start-session \ --target ec2-instance-id \ --document-name AWS-StartPortForwardingSessionToRemoteHost \ --parameters '{"host":["remote-hostname"],"portNumber":["remote-port"],"localPortNumber":["local-port"]}' \ --region aws-region example: aws ssm start-session --target i-036ac13130d27526c --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters '{"host":["database-1-instance-1.c4xgm0ct6ev4.eu-west-1.rds.amazonaws.com"],"portNumber":["5432"],"localPortNumber":["5432"]}' --region eu-west-1
