6.2 Launching an RDS Instance - Lab

Go to RDS. Click get started now.

Steps:

• Select MySQL, and select Dev/Test one. Click Next.

• In the Instance Specification, you can choose a DB Instance Class to be t2-micro, and don't choose Multi-AZ deployment. Leave everything else as default.

• In the Settings, give the DB instance a identifier, username and password.

• Use default VPC and subnet group, and make it not publicly accessible. For VPC security group, select Create new Security Group.

• Leave everything else as default, and Launch DB instance.

• Select the created DB instance, and go to find the security group of it, and then click it, you will get to the security group console, so that you can configure the security group of this DB instance.

• You should allow the traffic in (source) from MyWebDMZ, on port 3306. You may get a scenario question where you create an instance that is not publicly accessible, but for some reason you can access it. In this case, the very first thing you should do is opening up your security group to the security group that your web service exists in. That is what we do here, we are opening up the security group to port 3306 which is MySQL port, and we are allowing any web server that sits in the web server security group (MyWebDMZ) to be able to communicate to MySQL instances in this security group.

• Go to launch an EC2 instance. Copy the script (on Udemy) and paste it to the Advanced Details -> User data (as text), which will install Apache httpd server and PHP and PHP MySQL, and create a index.php webpage, and finally wget a connect.php file from a S3 bucket location. And then leave everything else as default. In the security group configuration step, you need to add this instance into the MyWebDMZ security group, so that this instance can communicate with DB instance (because the source of the security group of your DB instance is MyWebDMZ). Launch the instance.

• When your EC2 instance and DB instance are alive, you can use IP address of EC2 instance to visit the web server, and then SSH into this EC2 instance.

• In MAC laptop, you can use "ssh ec2-user@[ip-address] -i [ec2-key-pair-name].pem" to SSH into the EC2 instance.

• Then switch to root user. Go to /var/www/html directory. Type ls. You can see there are two files, connect.php and index.php.

• Use "nano connect.php" to go into this file, and change the $hostname to be the End Point of your DB instance (you can find it in the DB instance console). Hit ctrl+x to save it and exit.

• Now, you can visit "[IP-address-of-EC2-instance]/connect.php" in the browser, it will tell you the MySQL DB instance is connected. Although we set the DB instance is not publicly accessible when we launched it, we connected it through the security group.

• Go to VPC Dashboard and go to Security Group, select the rds-launch-wizard security group, and select its inbound rules. You can delete this inbound rule and click save and then see what happens. You will find that we cannot visit "[IP-address-of-EC2-instance]/connect.php" anymore, because we are untrusted the MyWebDMZ security group.

• This is a common exam question. When you cannot connect to your RDS instance, what could be the cause. They should always check that you are allowing in port 3306 in your RDS security group and you actually trusting the MyWebDMZ security group.

• The key thing to take away from this lecture is that you have two separate security groups, one for EC2 instance, one for RDS instance, and then allowing the RDS port 3306 through your RDS instance from your web service (e.g. EC2 instance) security groups.

• When you finish this lab, you can delete the RDS instance and the EC2 instance.

Monitoring for RDS

In the basic monitoring package for RDS, CloudWatch provides (mainly below, but have more):

• Database visible metrics such as number of connections

• CPU Utilization

• Disk IOPS metrics

• Database memory usage

• Storage space availability

• Replica lagging time

• Read/Write latency

• Read/Write throughput

• Network IO throughput