Cross Account DMS Replication for RDS instances behind Bastion machines

1
votes

I have production stacks inside a Production account and development stacks inside a Development account. The stacks are identical and are setup as follows:

  • Each stack as its own VPC.
  • Within the VPC are two public subnets spanning to AZs and two private subnets spanning to AZs.
  • The private Subnets contain the RDS instance.
  • The public Subnets contain a Bastion EC2 instance which can access the RDS instance.

To access the RDS instance, I either have to SSH into the Bastion machine and access it from there, or I create an SSH tunnel via the Bastion to access it through a Database client application such as PGAdmin.

Current DMS setup:

I would like to be able to use DMS (Database Migration Service) to replication an RDS instance from Production into Development. So far I am trying the following but cannot get it to work:

Create a VPC peering connection between Development VPC and Production VPC Create a replication instance in the private subnet of the Development VPC Update the private subnet route tables in the development VPC to route traffic to the CIDR of the production VPC through the VPC peering connection Ensure the Security group for the replication instance can access both RDS instances.

Main Problem:

When creating the source endpoint in DMS, the wizard only shows RDS instances from the same account and the same region, and only allows RDS instances to be configured using server names and ports, however, the RDS instances in my stacks can only be accessed via Bastion machines using tunnelling. Therefore the test endpoint connection always fails.

Any ideas of how to achieve this cross account replication?

Any good step by step blogs that detail how to do this? I have found a few but they don't seem to have RDS instances sitting behind bastion machines and so they all assume the endpoint configuration wizard can be populated using server names and ports.

Many thanks.

1
amazon-web-servicesamazon-rdsamazon-dms

1 Answers

0
votes

Securing the RDS instances via the Bastion host is sound security practice, of course, for developer/operational access.

For DMS migration service however, you should expect to open security group for both the Target and Source RDS database instances to allow the migration instance to have access to both.

From Network Security for AWS Database Migration Service:

The replication instance must have access to the source and target endpoints. The security group for the replication instance must have network ACLs or rules that allow egress from the instance out on the database port to the database endpoints.

Database endpoints must include network ACLs and security group rules that allow incoming access from the replication instance. You can achieve this using the replication instance's security group, the private IP address, the public IP address, or the NAT gateway’s public address, depending on your configuration.

See https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.Network.html

For network addressing and to open the RDS private subnet, you'll need a NAT on both source and target. They can be added easily, and then terminated after the migration.

You can now use Network Address Translation (NAT) Gateway, a highly available AWS managed service that makes it easy to connect to the Internet from instances within a private subnet in an AWS Virtual Private Cloud (VPC).

See https://aws.amazon.com/about-aws/whats-new/2015/12/introducing-amazon-vpc-nat-gateway-a-managed-nat-service/