Using Session Manager to connect RDS without having EC2 instance

Question

When I go through the documents, using session manager we can connect instance in private subnet without having bastion host itself [direct port forwarding from local to private ec2].

But in RDS case, even though we are making connection using session manager we need a EC2 instance in between local and private RDS.

Could you anyone explain me why it is like that? please share some document that explains that as well.

Uwe K · Accepted Answer

Hi Vignesh,
though we sometimes *do* document what is *not* possible, I'm not aware of a document that would explain why you cannot connect directly to RDS using SSM. So let me resort to a more generic answer:

SSM allows many more functions - and changes! - to an instance than just connecting to it. Having full SSM functionality on an RDS instance thus would undermine the **Shared Responsibility Model** we use for RDS (you could also say: it would violate the "Black Box" principle of RDS).
Therefore, you need an intermediary instance that forwards the TCP Port exposed by RDS to your local machine.

Further reading:
* The RDS-specific Shared Responsibility Model is explaine in "[Security in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.html)"
* Our general overview of the [Shared Responsibility Model](https://aws.amazon.com/compliance/shared-responsibility-model/)
* In case you don't know already, the EC2 instance can be in a private subnet, too, as explained here: [Securely connect to an Amazon RDS or Amazon EC2 database instance remotely with your preferred GUI](https://aws.amazon.com/blogs/database/securely-connect-to-an-amazon-rds-or-amazon-ec2-database-instance-remotely-with-your-preferred-gui/)

If this helped you, kindly mark my answer as "accepted".
Kind regards, Uwe

Using Session Manager to connect RDS without having EC2 instance

Relevant content