Creating a Private Postgres RDS instance with a Bastion Host using CDK & SSM

7 min readMar 20, 2024

Private Postgres RDS instance with a Bastion Host using CDK & SSM

Introduction

In this article we will show how to create a Private Postgres RDS instance with Secrets Manager in CDK with a Bastion Host using SSM

We will be using AWS CDK in Java to create this project but similar steps can be done in the language of your choice as well. The CDK code presented can be leveraged for other languages as the steps should be very similar.

By placing an RDS instance in a Private Subnet we are following best practices by avoiding public access to the RDS instance. This will require a bastion host that will allow people to access it via the public subnet. This is a best practices approach.

Business Case

The leprechauns love gold and to hide their treasure(sometimes at the end of rainbows). The want to build a treasure database to record their treasures and locations. This way they will not lose their treasure and can find it when they need it!

Architecture Diagram

Private PostgreSQL RDS instance in custom VPC with Secrets Manager and Bastion Host

The above represents what will be deployed in this article. A custom VPC will be deployed with a public subnet and private subnet across 3 availability zones.

We are deploying a PostgreSQL instance within one private subnet. It will be configured to use Secrets Manager for it’s credentials. Additionally a VPC Endpoint will be deployed so that Lambdas can reach the Secrets Manager credentials to authenticate to the RDS instance. An article will be written to show how to deploy a Spring Boot Application on AWS Lambda once we have deployed the above configuration.

Building the CDK Project

Validate the Prerequisites (See the Appendix)

2. Create the CDK Project

cd c:\projects
mkdir javacdk-private-postgres
cd javacdk-private-postgres
cdk init app --language java

2. Open the project up in Eclipse

File -> Open Projects from File System

Your CDK Project should have the following structure based on the code found at https://github.com/collin-smith/javacdk-private-postgres. The key class to update is JavacdkPrivatePostgresStack.java which can be found in the repo just listed above.

Build the project and press Run as seen below(Right Click the Project in project explorer, Run As.., Maven Build.., Type “clean install” in the Goals field then press Run.)

It should then build as follows:

Make sure you have your environment setup properly to deploy to the correct account, region etc.

cd c:\projects\javacdk-private-postgres
cdk bootstrap
cdk synth
cdk deploy

After deploying the CDK app with “cdk deploy” you will see something like the following:

After “cdk deploy”

Looking in the AWS Console

We can see that a postgres RDS instance has been created as follows:

Take note of the endpoint above as you will need that for when you want to log into the database with pgAdmin.

We can also see that a Secrets Manager Secret was created that holds the credentials to the RDS instance

Bastion Host

As our RDS is located in a private VPC, we will use a bastion host to connect to the RDS database. This will be an EC2 instance that was created in a public subnet.

Now to gain access to the Bastion host, we will start a session with AWS System Manager. See Start a session for more information.

We will run the following command with the right region, ec2 instance id, and RDS endpoint information. And ensure that you have configured your AWS environment correctly as well for the console session.

aws ssm start-session --region us-west-2 --target i-0dcf9a0f472079a6e --document-name AWS-StartPortForwardingSessionToRemoteHost --parameters host="javacdkprivatepostgresstack-rds.cyxxifivnm0n.us-west-2.rds.amazonaws.com",portNumber="5432",localPortNumber="5432"

You should now see that a session has been started with your bastion host

We are not allowing public access to the Postgres RDS instance but only from the bastion host as detailed in the Ingress rule below. If we have other services such as lambdas or EC2s then similar configurations can be done for them with ingress rules with security groups can be done.

Now you can configure the Bastion Host security group to only allow specific IP traffic that you determine.

databaseSecurityGroup.addIngressRule(bastionSecurityGroup, Port.tcp(5432), "PostgreSQL From the bastion Security group");

Using the pgAdmin database client

Open up pgAdmin, Right click Server/Register/Server… and enter in the the name of the server leprechaun

Click on Connection and enter the host name as 127.0.0.1 that you can see in the console or in the output of your CDK console. Enter in the username and password from the Secret above which you can get from the AWS Console.

Then you should press Save

If all works well, you should now have access to the instance

Let’s now create a database leprechaun by right-clicking Database(s)/Create/Database… and type in leprechaun and press save

Right click the leprechaun database and open up the Query Tool

You can now run the following command to create the Treasure table

CREATE TABLE TREASURE
(
ID SERIAL PRIMARY KEY,
DESCRIPTION VARCHAR(50),
LOCATION VARCHAR(600),
CREATED TIMESTAMP
);

Press the Execute button to run the script and Successfully create the table

Then you can INSERT a record into the table

INSERT INTO TREASURE (DESCRIPTION, LOCATION, CREATED) VALUES ('POT OF GOLD', 'UNDER THE RAINBOW', NOW());

Then you can Query to see if the record is now in the database

SELECT * FROM TREASURE;

Now you have successfully created an RDS instance that you created with CDK and have created a database with a table.

If you wanted to create a spring boot lambda application to interact with this database please continue on to https://collin-smith.medium.com/creating-a-spring-boot-java-21-application-with-a-public-postgres-rds-230ea9ac14bc

Tidying up

Once you have finished with your PostgreSQL RDS instance please execute a “cdk destroy” to remove the resources.

cdk destroy

Conclusion

In this article, you have seen how you can create a Private Postgres RDS Instance with Secrets Manager with CDK & SSM. This was done using Java but the same principle can be done for any of the languages supported by CDK. With a Custom VPC you can create the right networking to help support the AWS workload that you want to create rather than rely on the default VPC.

As previously mentioned you can create a Spring Boot application to interact with this database at Creating a Spring Boot Java 21 application with a Private Postgres RDS

Now if you want to read on to other related to the concept of Java 21 Spring Boot with database implementations, please consider the following articles as well:

Appendix

Prerequisites

Access to an AWS Account

Java 21 — The latest Java version to date can be downloaded from here

Confirm that you have the right version in your command line