7.3 VPC Lab - Part 2

We will learn how to make the public instance to communicate with the private instance. Actually, the public instance can be seen as a web server which is accessible to the clients, and the private instance can be seen as a database server which cannot be accessed by the clients directly. This is why we need a public instance and a private instance.

Steps:

• Rename the public instance to webserver01 and the private instance to myMysql.

• Create a new security group. Name: My-RDS-SG. VPC: the VPC you created in the lab part 1. Add rules: SSH (source: 10.0.1.0/24), MySQL/Aurora (source: 10.0.1.0/24), HTTP (source: 10.0.1.0/24), HTTPS (source: 10.0.1.0/24), All ICMP (source: 10.0.1.0/24. Allow you to ping the private instance from a public instance). Click Create.

• Go to EC2 dashboard and move the myMysql instance (private instance) to My-RDS-SG security group. (Action -> Networking -> Change Security Group).

• Go to SSH into the web server instance (public instance), and to see whether we can ping to the private instance so that we can SSH into the private instance from the public instance. (You need to upload the private key of the private instance to the public instance so that to SSH to the private instance, but NEVER do this in production environment).

• In your public instance: ping [the-private-instance-ip-address]. Create a file and copy the private key into it: nano mypvk.pem, then copy the key into this file. Change the permission of it: chmod 400 mypvk.pem. Then you can SSH to your private instance from the public instance: ssh ec2-user@[the-private-instance-ip-address] -i mypvk.pem

• So now you have SSH into the private instance. When you run: yum update -y, nothing will happen because now you are in a private subnet whose associated route table doesn't have a route to the outside Internet, so you have no route out to the Internet.

How do we provide Internet accessibility to this private instance so that we can install MySQL and make this instance to be a database server? We will solve this problem in the next lecture.

Working with a DB Instance in a VPC

If you are working with a DB instance in a VPC instead of installing DB engine on EC2 instance like this lab, you need to make sure:

• Your VPC must have at least one subnet in at least two of the Availability Zones in the region where you want to deploy your DB instance.

• If you want your DB instance in the VPC to be publicly accessible, you must enable the VPC attributes DNS hostnames and DNS resolution.