来自不同 VPC 的 Lambda RDS 代理连接

Question

我有两个 AWS 账户，其 VPC 与对等连接相连。我在帐户 1 上有 RDS 代理，在帐户 2 上的私有隔离子网中有 Lambda。

我不知道如何连接到 RDS Proxy。我正在尝试所有可能的 VPC 端点和接口等等。

我设法连接的唯一方法是通过 NAT 网关，但它很昂贵。老实说，奇怪，如果我想保留一个私人网络。

能不能搞个PrivateLink之类的？我应该如何从 Lambda 连接到 RDS Proxy？

我已附上 CF 模板（我希望我清除了所有敏感数据）：

{
  "Resources": {
    "vpcA2121C38": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.0.0.0/16",
        "EnableDnsHostnames": true,
        "EnableDnsSupport": true,
        "InstanceTenancy": "default"
      },
      "Metadata": {
        "aws:cdk:path": "Mws/vpc/Resource"
      }
    },
    "vpcPrivateSubnet1Subnet934893E8": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": "10.0.0.0/26",
        "VpcId": {
          "Ref": "vpcA2121C38"
        },
        "AvailabilityZone": {
          "Fn::Select": [
            0,
            {
              "Fn::GetAZs": ""
            }
          ]
        },
        "MapPublicIpOnLaunch": false
      },
      "Metadata": {
        "aws:cdk:path": "Mws/vpc/PrivateSubnet1/Subnet"
      }
    },
    "vpcPrivateSubnet1RouteTableB41A48CC": {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": {
          "Ref": "vpcA2121C38"
        }
      },
      "Metadata": {
        "aws:cdk:path": "Mws/vpc/PrivateSubnet1/RouteTable"
      }
    },
    "vpcPrivateSubnet1RouteTableAssociation67945127": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "RouteTableId": {
          "Ref": "vpcPrivateSubnet1RouteTableB41A48CC"
        },
        "SubnetId": {
          "Ref": "vpcPrivateSubnet1Subnet934893E8"
        }
      },
      "Metadata": {
        "aws:cdk:path": "Mws/vpc/PrivateSubnet1/RouteTableAssociation"
      }
    },
    "vpcS3CB758969": {
      "Type": "AWS::EC2::VPCEndpoint",
      "Properties": {
        "ServiceName": {
          "Fn::Join": [
            "",
            [
              "com.amazonaws.",
              {
                "Ref": "AWS::Region"
              },
              ".s3"
            ]
          ]
        },
        "VpcId": {
          "Ref": "vpcA2121C38"
        },
        "RouteTableIds": [
          {
            "Ref": "vpcPrivateSubnet1RouteTableB41A48CC"
          }
        ],
        "VpcEndpointType": "Gateway"
      },
      "Metadata": {
        "aws:cdk:path": "Mws/vpc/S3/Resource"
      }
    },
    "vpcPeertomainaccount833D3E2C": {
      "Type": "AWS::EC2::VPCPeeringConnection",
      "Properties": {
        "PeerVpcId": "vpc-f04b939b",
        "VpcId": {
          "Ref": "vpcA2121C38"
        },
        "PeerOwnerId": "XXXX__ACCOINT_1__XXXXXX",
        "PeerRoleArn": "arn:aws:iam::XXXX__ACCOINT_1__XXXXXX:role/VPCPeerConnection"
        
      },
      "Metadata": {
        "aws:cdk:path": "Mws/vpc/Peer to main account"
      }
    },
    "producerServiceRoleEBCB54D0": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "ManagedPolicyArns": [
          {
            "Fn::Join": [
              "",
              [
                "arn:",
                {
                  "Ref": "AWS::Partition"
                },
                ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
              ]
            ]
          },
          {
            "Fn::Join": [
              "",
              [
                "arn:",
                {
                  "Ref": "AWS::Partition"
                },
                ":iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
              ]
            ]
          }
        ]
      },
      "Metadata": {
        "aws:cdk:path": "Mws/producer/producer/ServiceRole/Resource"
      }
    },
    "producerServiceRoleDefaultPolicyEA5B80A1": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "xray:PutTraceSegments",
                "xray:PutTelemetryRecords"
              ],
              "Effect": "Allow",
              "Resource": "*"
            },
            {
              "Action": [
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
              ],
              "Effect": "Allow",
              "Resource": [
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":s3:::",
                      {
                        "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                      }
                    ]
                  ]
                },
                {
                  "Fn::Join": [
                    "",
                    [
                      "arn:",
                      {
                        "Ref": "AWS::Partition"
                      },
                      ":s3:::",
                      {
                        "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                      },
                      "/*"
                    ]
                  ]
                }
              ]
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "producerServiceRoleDefaultPolicyEA5B80A1",
        "Roles": [
          {
            "Ref": "producerServiceRoleEBCB54D0"
          }
        ]
      },
      "Metadata": {
        "aws:cdk:path": "Mws/producer/producer/ServiceRole/DefaultPolicy/Resource"
      }
    },
    "producerSecurityGroup9AA1BE28": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Automatic security group for Lambda Function Mwsproducer416E938A",
        "SecurityGroupEgress": [
          {
            "CidrIp": "0.0.0.0/0",
            "Description": "Allow all outbound traffic by default",
            "IpProtocol": "-1"
          }
        ],
        
        "VpcId": {
          "Ref": "vpcA2121C38"
        }
      },
      "Metadata": {
        "aws:cdk:path": "Mws/producer/producer/SecurityGroup/Resource"
      }
    },
    "producerAD962441": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Code": {
          "S3Bucket": {
            "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
          },
          "S3Key": "dc05df325f7034421a587e7ee47aed301c7472d001152e686053dd9d5c45c164.zip"
        },
        "Role": {
          "Fn::GetAtt": [
            "producerServiceRoleEBCB54D0",
            "Arn"
          ]
        },
        "Description": "Produces MWS customer orders messages",
        "Environment": {
          "Variables": {
            "DB_HOST": "mws-rds-proxy.proxy-XXXXXXXXX.eu-central-1.rds.amazonaws.com",
            "DB_NAME": "dev"
          }
        },
        "Handler": "lambda/mws_producer.php",
        "Layers": [
          "arn:aws:lambda:eu-central-1:209497400698:layer:php-80:18"
        ],
        "MemorySize": 1024,
        "Runtime": "provided.al2",
        
        "Timeout": 900,
        "TracingConfig": {
          "Mode": "Active"
        },
        "VpcConfig": {
          "SecurityGroupIds": [
            {
              "Fn::GetAtt": [
                "producerSecurityGroup9AA1BE28",
                "GroupId"
              ]
            }
          ],
          "SubnetIds": [
            {
              "Ref": "vpcPrivateSubnet1Subnet934893E8"
            }
          ]
        }
      },
      "DependsOn": [
        "producerServiceRoleDefaultPolicyEA5B80A1",
        "producerServiceRoleEBCB54D0"
      ]
    }
  }
}

Answer 1

我们所知道的恶魔隐藏在细节中。在这种情况下，它是一个路由表。

当我们在 VPC 之间创建对等连接时，我们还需要了解我们的子网如何使用它。基本上，只需添加对等连接 ID (pcx-XXX) 作为对等网络的目标。

我花了几天时间才意识到这一点。开心开心开心！

来自不同 VPC 的 Lambda RDS 代理连接

Lambda RDS Proxy connection from different VPC

amazon-web-services

amazon-rds

amazon-vpc

aws-lambda

amazon-rds-proxy