使用AWS CDK TypeScript本地连接RDS失败，请求排查问题

问题背景 #

作为AWS CDK及基础设施新手，已实现Fargate集群连接RDS数据库，但本地始终无法连接，以下是相关TypeScript CDK代码：

const vpc = new ec2.Vpc(this, 'TestVpc', {
  maxAzs: 2, // Adjust the number of availability zones as needed
});

const clusterSecurityGroup = new ec2.SecurityGroup(
  this,
  'ClusterSecurityGroup',
  {
    vpc,
  },
);
clusterSecurityGroup.addIngressRule(
  ec2.Peer.ipv4(`${myIp}/32`),
  ec2.Port.allTraffic(), // Replace with the desired port or specific port(s)
  'Allow inbound access from specific IP',
);

const database = new rds.DatabaseInstance(this, 'TestDatabase', {
  databaseName: 'myrnamethod',
  engine: rds.DatabaseInstanceEngine.POSTGRES,
  publiclyAccessible: true, // Allow public access
  credentials: rds.Credentials.fromPassword(
    process.env.DB_USERNAME as string,
    cdk.SecretValue.unsafePlainText(process.env.DB_PASSWORD as string),
  ),
  instanceType: ec2.InstanceType.of(
    ec2.InstanceClass.T4G,
    ec2.InstanceSize.MICRO,
  ),
  vpc,
  securityGroups: [clusterSecurityGroup],
});

const loadBalancedFargateService =
  new ecsPatterns.ApplicationLoadBalancedFargateService(
    this,
    'TestService',
    {
      memoryLimitMiB: 512,
      cpu: 256,
      taskImageOptions: {
        image: ecs.ContainerImage.fromAsset('../', {
          file: 'Dockerfile',
        }),
        containerPort: 3000,
      },
      vpc,
      securityGroups: [clusterSecurityGroup],
    },
  );
database.connections.allowFrom(
  ec2.Peer.ipv4(`${myIp}/32`),
  ec2.Port.allTraffic(),
  'Allow inbound access from local machine',
);

database.connections.allowDefaultPortFrom(
  loadBalancedFargateService.service,
  'Allow inbound access from ECS Fargate service',
);
database.connections.allowFrom(
  clusterSecurityGroup,
  ec2.Port.tcp(database.instanceEndpoint.port),
  'Allow inbound access from ECS cluster',
);

核心问题点 #

• RDS子网配置错误：AWS CDK默认创建的VPC包含公有和私有子网，RDS默认会被部署到私有子网。即使设置了publiclyAccessible: true，私有子网没有指向互联网网关的路由，RDS无法暴露公网端点，本地自然无法连接。
• 安全组规则冗余且范围过大：使用ec2.Port.allTraffic()开放所有端口没必要，应该仅开放PostgreSQL默认端口5432；另外要确认myIp变量是否正确获取了你的公网IP（家庭网络IP多为动态，可能已变化）。
• 未指定RDS子网组：没有显式指定RDS使用公有子网组，导致RDS默认选择私有子网部署。

修复方案 #

1. 创建RDS公有子网组：显式指定RDS部署到VPC的公有子网
2. 限制安全组端口范围：仅开放数据库所需的5432端口
3. 确认本地公网IP正确性：通过查询当前设备的公网IP，确保myIp变量值与实际一致

修改后的关键代码片段：

// 创建RDS公有子网组
const rdsPublicSubnetGroup = new rds.SubnetGroup(this, 'RDSPublicSubnetGroup', {
  vpc,
  vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC }, // 指定公有子网
  description: 'Subnet group for RDS public access',
});

// 修改RDS实例配置，关联公有子网组
const database = new rds.DatabaseInstance(this, 'TestDatabase', {
  databaseName: 'myrnamethod',
  engine: rds.DatabaseInstanceEngine.POSTGRES,
  publiclyAccessible: true,
  credentials: rds.Credentials.fromPassword(
    process.env.DB_USERNAME as string,
    cdk.SecretValue.unsafePlainText(process.env.DB_PASSWORD as string),
  ),
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.T4G, ec2.InstanceSize.MICRO),
  vpc,
  securityGroups: [clusterSecurityGroup],
  subnetGroup: rdsPublicSubnetGroup, // 添加子网组配置
});

// 修正安全组规则，仅开放PostgreSQL端口
clusterSecurityGroup.addIngressRule(
  ec2.Peer.ipv4(`${myIp}/32`),
  ec2.Port.tcp(5432),
  'Allow PostgreSQL access from local IP',
);

database.connections.allowFrom(
  ec2.Peer.ipv4(`${myIp}/32`),
  ec2.Port.tcp(5432),
  'Allow PostgreSQL access from local machine',
);

内容的提问来源于stack exchange，提问作者jawn