How to use SSH Tunnel to connect to an RDS instance via an EC2 instance?

Question

So this is really new to me, so apologies if this is a dumb question.

I have a RDS instance that is not publicly accessible and is sitting in its own private VPC. I have an EC2 instance that is allowed to connect to RDS, but nothing else is allowed to connect to the instance.

I now want PgAdmin to be able to show data from my RDS instance.

I went through the wizard in PgAdmin, I put in the EC2 Instance's Public IP as Tunnel host, the username is ec2-user and the authentication is by identity file (using the pem file that I use to ssh into the instance).

However, I still can't connect. In the Advanced tab, PGAdmin asks for a Host address, but complains when I put in my RDS instance's endpoint.

How do I get my local pgAdmin to now access my DB which is no longer accessible to the public internet?

--- forgot to add the error message

Unable to connect to server:

Failed to create the SSH tunnel.
Error: Could not establish session to SSH gateway

Answer 1

It appears that you wish to use an Amazon EC2 instance with port forwarding to access a private Amazon RDS instance that is in the same VPC.

Here is how I configure such connections.

1. Confirm that SSH works to the EC2 instance

First, confirm that you can SSH into the EC2 instance. You would use a command similar to:

ssh -i key.pem ec2-user@IP-ADDRESS

2. Use port forwarding

If the above works, then modify the SSH command to use port forwarding:

ssh -i key.pem -L 5432:RDS-HOST-NAME:5432 ec2-user@IP-ADDRESS

This will forward port 5432 on your own computer to the EC2 instance via SSH. Then, any traffic sent to localhost:5432 will be forwarded across the SSH connection. The EC2 instance will then send the traffic to RDS-HOST-NAME:5432. (Replace RDS-HOST-NAME with the DNS Name of the RDS database.)

3. Point PgAdmin to the connection

In PgAdmin, refer to the database as: localhost:5432

You can, of course, use a different port number in the port forwarding connection. This can be useful if forwarding multiple connections to different databases. However, I like to keep them the same if possible.