I use Oracle Compute instances and Oracle Autonomous Database (ATP).
I want to allow compute instances to access only Autonomous Databases and I don't want to allow compute instances access to other public network.
I tried to set up an egress rule by security lists, but Autonomous Database's ip address is subject to change.
I think this approach is inappropriate.
My license is Oracle Cloud Infrastructure Free Tier.
So, I can't use Private Endpoint Access to Autonomous Database.
Do you have a solution to allow compute instances to access only Autonomous Databases?
You can use a Service Gateway on your VCN and remove NAT/IGW. This way the VCN will only be connected to OCI services, which includes Autonomous.
https://docs.oracle.com/en/cloud/paas/autonomous-database/adbsa/access-service-gateway.html#GUID-76D412D4-03F4-49BA-B70C-DEA70B11AC34
Related
I have the possibility to use a shared mysql server offered by a reliable Italian cloud provider (Aruba). The service satisfies my performance needs and would notably simplify my infrastructure.
My concern is that this shared mysql service (DBaaS) is only offered with public ip address exposed on the internet, authentication with userid and password and SSL connection.
The data that I would move to this server are reservations and accounting for a certain number of hotels. It's definitely critical and confidential data and a data breach would be definitely a disaster.
Till now, my infrastructure is based on a firewall that only exposes the web server, while the database server is a custom VM connected through a virtual switch and not visible on the internet.
How bigger is the danger of such an infrastructure (DBaaS with public ip address) compared to my actual setup with a private VM running mysql on an internal IP address?
PROS: security, updates and firewalling would be managed by the cloud provider in a more consistent and persistent way
CONS: exposure on the internet
I'm new to cloud computing so this might be an obvious question. I have a desktop Java application that will connect to an AWS RDS MySQL database using JDBC. Is using the endpoint, username and password for the database the preferred commercial way of connecting to the database?
To encrypt communication I plan to use SSL.
You could open your database instance to the outside, using regular credentials. But, a safer way to proceed might be to create an endpoint in AWS, possibly running in Java, which would expose one or more APIs which in turn would hit the MySQL database running in RDS. That is, you would not expose the RDS instance to the outside world directly, but only internally to this API, also running in AWS. Then, your desktop Java application would talk to this intermediary application when it needs to access the database.
The advantage of this suggestion is that it lessens the risk of your RDS instance being attacked via something like DOS. Of course, the API you create on top of the database could also be attacked. But, Java web application running in a container (and other similar applications in other languages) were designed to be exposed to the outside, much less so database instances.
Lets say I have a VM instance and I then make a connection to the Cloud SQL instances IP using a MySQL client. According to the comparison table in Connection Options for External Applications, connecting with no SSL is apparently not secure (and non-encrypted).
But to what extent is it insecure? If there is a man-in-the-middle attack, query and query results could be seen. I would like to determine how big of a risk that is.
Specifically I would like to know the risks of connecting from:
A VM in the exact same zone to a Cloud SQL instance
A VM in the same region, but a difference zone to a Cloud SQL instance
A VM in another region to a Cloud SQL instance, but still from GCP
I assume that for any of these kinds of attacks to be carried out, the actual google infrastructure would have to have been compromised as it wouldn't be possible for a VM to listen to traffic outside a network that it's attached to.
The actual infrastructure wouldn't have to be compromised actually, all that it'd take is for an instance in the same network to be compromised for the details of your connection to Cloud SQL to potentially be compromised. Seeing as maintaining the instances up-to-date is a responsibility of the users, that means that the security of an insecure connection to Cloud SQL also depends on the security of your instances.
Why exactly are you doing insecure connections? I ask because it's incredibly easy to setup a safe connection from an instance to Cloud SQL by using Cloud SQL Proxy! Not to toot my own horn here, but take a look at
this answer I gave a while ago about why you should be using the Proxy.
Regardless, and keeping in mind that Cloud SQL is nothing more than a managed instance exclusively accessible via its public IP, the traffic should stay within GCP in all three of those scenarios, meaning the only thing that is likely to be compromised are the instances in the same sub-network as that of the instance that's connecting to Cloud SQL.
I have multiple environments in Google Compute Engine (dev, staging, and production), each with its own Google Cloud SQL instance. The instances connect via Cloud SQL Proxy and authenticate with a credential file that is tied to a service account. I want to have a separate service account for each environment, which would be restricted to accessing the SQL instance specific to that environment. Currently, it appears that any service account with role Cloud SQL Client can access any Cloud SQL instance within the same project.
I cannot find any way to restrict access on a Cloud SQL Instance to a specific service account. Is it possible, and if so, how? If not, is there a different way to achieve the goal of preventing a server in one environment from accessing a Cloud SQL instance in another environment?
NOTE: this configuration is possible with Google Cloud Storage; one can assign a specific service account to have various permissions on each bucket, so that the dev service account cannot accidentally access Production files.
Unfortunately, Cloud SQL currently does not support instance level IAM policies.
The only workaround is hosting the instances in different projects.
As of the August 2021 release of Google Cloud SQL:
You can use IAM Conditions to define and enforce conditional, attribute-based access control for Google Cloud resources, including Cloud SQL instances
See the documentation for IAM Conditions for information about how to restrict a user or service account to specific Cloud SQL instances.
I recently inherited an AWS account's maintenance and noticed that the db access is wide open to any network, anywhere! So I decided it must be simple like it is when we do it with our own VMs. Except on Amazon AWS EC2 instances have an internal IP and a public IP and sometimes an elastic IP. So I thought ok I'll search google and find a simple quick writeup, and there doesn't seem to be one. So can someone please provide a simple writeup, here, on how to do this. I understand there are three methods on the RDS security and so forth. If you don't have time or desire to cover all three please just pick the one you like and have used for the example. If I don't get a good response on this within a day or so I'll hit the docs and piece it together myself, thank you in advance!
Well I tinkered with it a bit. The docs are not too suggestive. I found on an EC2 instance that has an Elastic IP assigned I had to use the Private IP allowed in the security group I applied to the RDS MySQL database. The Elastic IP assigned or UN-assigned did not affect connection. On the EC2 instance which had no Elastic IP assigned I had to use the Public IP allowed in the security group. The Private IP did not matter. This seems a bit strange to me.
An Amazon Relational Database Service (RDS) instance should typically be kept private to prevent access from the Internet. Only in rare circumstances should an RDS instance be accessible on the Internet.
An RDS instance can be secured in several ways:
1. Launch it in a Private Subnet
A Virtual Private Cloud (VPC) can be configured with public and private subnets. Launching the RDS instance in the private subnet will prevent access from the Internet. If access is still required across the Internet (eg to your corporate network), create a secure VPN connection between the VPC and your corporate network.
2. Use Security Groups
Security Groups operate like a firewall around each individual EC2 instance. They define which ports and IP address ranges are permitted for inbound and outbound access. By default, outbound access is permitted but inbound access is NOT permitted.
3. No Public IP address
If an RDS instance does NOT have a Public IP address, it cannot be directly accessed from the Internet.
4. Network Access Control Lists
These are like Security Groups, but they operate at the Subnet level. Good for controlling which app layers can talk to each other, but not good for securing specific EC2 or RDS instances.
Thus, for an RDS instance to be publicly accessible, it must have all the following:
A public IP address
A Security Group permitting inbound access
Located in a public subnet
Open Network ACL rules
For your situation, I would recommend:
Modify the RDS instance and set PubliclyAccessible to False. This will remove the public IP address.
Create a new Security Group (I'll refer to it as "SG1") and assign it to the single EC2 instance that you want to allow to communicate with the RDS instance
Modify the Security Group associated with the RDS instance and allow Inbound communication from SG1 (which permits communication from the EC2 instance). Note that this refers to the SG1 security group itself, rather than referring to any specific IP addresses.