how to access mongodb instance outside a VPC

Question

I followed the AWS quickstart guide for creating a MongoDB cluster. This created a NAT Instance (Public subnet) as well as a single PrimaryReplicaNode instance (internal IP only). I can SSH into the NAT and furthermore, I can SSH into the Primary Replica from the NAT. I've verified that MongoDB is accessible from the command line, but I have to get "through" two servers to get there.

On the other hand, I did a quickstart node.js server on Elastic Beanstalk. I also placed it within the same VPC and security groups as the NAT.

So I've got 3 total instances. 1 Elastic Beanstalk instance running node and 2 EC2 instances running as a MongoDB cluster.

My question is... how do I connect into MongoDB from the Elastic Beanstalk application?

Do I need to give Elastic Beanstalk the same key that I gave the NAT so it could access the internal Primary node? Or do I connect to the NAT's external address from Node.js and then tunnel into the cluster? What exactly needs to connect to what in order to make it serve its purpose?

Any advice would be much appreciated!

Answer 1

I would recommend using a CloudFormation template to create everything you need for the new VPC env. Here is a CloudFormation template provided by AWS which handles proper creation of a VPC (public / private subnets, nat gateway configs, security groups, etc). Was a huge help for me personally. https://docs.aws.amazon.com/codebuild/latest/userguide/cloudformation-vpc-template.html

From there you will need to create a new aws EB cluster. I would recommend saving you current config so can could use it to stand up the new env much more easily. But make sure to config the new env with your new VPC. You will still need to due the same for the mongo ec2 instances (make sure they are in the new VPC) and make another security group which has proper configs to access to the aws eb instances within the VPC.

With only one manual security group creation step (for the mongo instances) this is much cleaner and sure fire why to ensure everything is setup correctly from a networking perspective.

Now you just can tell your app to speak directly to your mongodb (using the private dns resolution for the mongo host within the VPC - note: enable dns resolution within the vpc upon creation!)

Hope this helps