Limiting External Access to AWS SQL Server Instance

Question

I have a SQL Server instance on AWS that I have opened to external access by altering my security group to allow access from “Everywhere".

+-------------+----------+------------+--------------------------+
|    Type     | Protocol | Port Range |         Source           |   
+-------------+----------+------------+--------------------------+
|    MSSQL    | TCP      |    1433    | Custom  0.0.0.0/0        |
|    MSSQL    | TCP      |    1433    | Custom  ::/0             | †
+-------------+----------+------------+--------------------------+

I would like to restrict this access to this database, though not via IP addresses since the service I will use to access it has no static IP.

How can I tighten inbound access to this database for use with an external service (eg Firebase function or NodeJS application)?

^{† AWS security group rule that is generated when "Everywhere" and "MSSQL" are selected in the Security Group inbound rules section}

Answer 1

AFAIK, there is no direct way to achieve this without knowing the static IP or the IP range from where you need to access your EC2 instance (Where you host your SQL Server).

But...

You can include your instance behind an API Gateway and then enable IAM authentication for the API method in the API Gateway. Then use IAM policies (along with resource policies) to designate permissions for your API's users.

More: https://aws.amazon.com/premiumsupport/knowledge-center/iam-authentication-api-gateway/

Answer 2

There is no direct way to restrict.

AWS Cloud - solution (all services / instance in AWS)

If your NodeJS application is running on AWS or you are using AWS Lambda service you can allow access across security groups alone within same VPC. (If multiple accounts used - VPC peering can be done)

Answer 3

For your scenario where you would like to restrict access to a publicly accessible database, like everyone else said, I couldn't think of a way other than the plain old VPN solution. You client connects to the database through the VPN and move the database instance to private subnets. But i am not sure how feasible it is for you to implement it.