RDS mai zaman kansa daga EC2: VPC ɗaya, peering ko wani abu dabam?

Kwamfutar ɗan mai haɓakawa tana isa ga rukunin RDS mai zaman kansa ta VPN ɗin ma’aikata, amma aikace-aikacen da ke kan EC2 ba zai iya haɗawa ko kaɗan ba. Wannan ba lalacewar turawa ba ce. Kwamfutar tana da rami wanda rukunin EC2 ba ya gado ko da yaushe, kuma «mai zaman kansa» a RDS yana nufin rukunin bayanai ba shi da tashar jama’a, ba wai masu amfani da VPN na mutane ne kaɗai masu izinin kira ba. Aikace-aikacen yana buƙatar hanyarsa da aka ba da izini, dangantakarsa da ƙungiyar tsaro da kuma shaidarsa ta rukunin bayanai, kuma tsarin da kuka zaɓa waɗannan uku a ciki yana ceton yawancin gyaran kuskure. Fara yanke shawara kan hanya, sannan izini, sannan tabbatar daga yanayin da aka tura maimakon daga teburinku.

VPN ɗin kwamfutar ba hanya ce ta aikace-aikacen ba

Duk abin da VPN ɗin ma’aikata ke yi wa mutane, ba ya yin komai ga rukunin, sai dai idan an bayyana cewa rukunin ɗin wani ɓangare ne na hanyar cibiyar sadarwa ɗaya. Rukunin EC2 a cikin ƙaramin cibiyar sadarwa mai zaman kansa yana isa RDS ta hanyar tura VPC, ƙungiyoyin tsaro da ACL na cibiyar sadarwa. Ba ya gado ramin mutum, zaman mutum ko takardun shaidar mutum, kuma bai kamata ya gado ba: dole ne haɗin aikace-aikacen mara kulawa da hanyar nesa ta ma’aikata su kasance masu aiki daban.

Wannan ’yancin kai siffa ce. Idan VPN ya ƙare, aikace-aikacen yana ci gaba da aiki. Idan aikace-aikacen ya yi kuskure, babu wanda ya rasa hanyarsa ta nesa. Tsare-tsaren da suka haɗa biyun cikin hanya ɗaya yawanci ana gano su a lokacin wani lamari, a mafi munin lokaci mai yiwuwa.

Shawara ta 1: VPC ɗaya, hanya kai tsaye

Lokacin da aikace-aikacen da rukunin bayanai suke cikin VPC ɗaya tare da tura kai tsaye kuma babu na’urar bincike tsakaninsu, hanyar tana da sauƙi kuma maganar ƙungiyar tsaro ita ce kayan aiki mafi ƙarfi da ake da shi. Ba aikace-aikacen ƙungiyarsa ta kansa, sannan ba da izinin tashar rukunin bayanai daga wannan ƙungiyar maimakon daga kewayon adireshi:

aws ec2 authorize-security-group-ingress --group-id sg-0db123   --protocol tcp --port 5432 --source-group sg-0app456

aws rds describe-db-instances --db-instance-identifier prod-db   --query 'DBInstances[0].{Endpoint:Endpoint.Address,Port:Endpoint.Port,Public:PubliclyAccessible,Groups:VpcSecurityGroups}'

Tashar misali ce kuma dole ta dace da injin. Maganar ƙungiya tana ba da izinin zirga-zirga daga rukunin aikace-aikacen; ba ta kwafin dokokinsu kuma ba ta ƙirƙirar shiga rukunin bayanai. Matsaloli biyu daban, mafita biyu daban.

Sannan duba sauran hanyar maimakon tsayawa a kan dokar da kuka ƙara yanzu. Manufar fitar da aikace-aikacen, cikakken jerin ƙungiyoyin da aka haɗa da rukunin bayanai, allunan tura ƙaramin cibiyar sadarwa da duk wani ACL na cibiyar sadarwa dole su dace. Dokokin ƙungiyar tsaro suna da yanayi, yayin da ACL na cibiyar sadarwa na al’ada dole ya ba da izinin buƙata da zirga-zirgar dawowa a cikin dokoki daban, har da tashoshin wucin gadi. Sabuwar ƙaramar dokar rukunin bayanai kuma ba ta soke tsohuwar izini mai faɗi da aka riga aka haɗa ba.

Shawara ta 2: wata VPC ko wani asusu

Idan aikace-aikacen yana cikin wata VPC, masu cibiyar sadarwa suna zaɓar haɗin sirri da aka goyi baya: peering, tsarin wucewa ko shirin VPC da aka raba. Sannan dole ne duka biyu na tura su kasance, warware suna dole ya yi aiki ga tashar RDS, kuma tushen da manufar rukunin bayanai ke kimantawa dole ya dace da abin da ke zuwa da gaske. Sunayen asusu masu kama ko alaƙar lissafin kuɗi da aka raba ba su bayar da ɗaya daga cikinsu ba.

Maganar ƙungiyar tsaro ita ce ɓangaren da ke bambanta. Tana aiki a yawancin tsare-tsaren haɗin sirri, amma tana daina aiki a lokacin da na’urar tsakiya ta sake rubuta tushe ko ta ƙare haɗin, domin rukunin bayanai yana ganin na’urar tsakiya maimakon ƙungiyar aikace-aikacenku. Yanayin VPC na RDS sun raba shiga cikin VPC ɗaya daga sauran shirye-shirye, kuma yana da kyau a duba takamaiman yanayin ku a kansu kafin ku ɗauka cewa salon doka yana wucewa.

Kada ku warware hanyar da ta ɓace ta hanyar sanya rukunin bayanai a bayyane ga jama’a. Wannan wata shawara ce ta fallasa da wani mai shi, kuma yawanci wanda ya fi nisa daga sakamakon ne ke ba da shawara.

Shawara ta 3: wace shaidar rukunin bayanai ke karɓa

Shiga cibiyar sadarwa da tabbatar da rukunin bayanai daban-daban ne, kuma haɗa su yana haifar da mafi yawan kuskuren ɓatarwa. Matsayin rukunin shaidar AWS ce don kiran API na AWS. Ba mai amfani da rukunin bayanai ba ne. Tabbatar da rukunin bayanai na IAM fasali ne da aka goyi baya inda injin da saitin suka yarda, kuma har yanzu taswira ce ga mai amfani da rukunin bayanai ba maye gurbinsa ba.

Yi amfani da sunan tashar RDS a cikin saitin aikace-aikacen maimakon adireshin da aka kama daga bincike ɗaya. Canjin Multi-AZ yana canza adireshin bayan wannan suna, kuma aikace-aikacen da aka manne wa IP zai gaza a daidai lokacin da ake buƙatarsa. Ka bar tabbatarwar TLS ta injin a kunne maimakon kashe ta don kuskure ya ɓace, domin gazawar tabbatarwa tana gaya muku wani abu game da tashar da kuka isa.

Sannan ba wa asusun rukunin bayanai mafi ƙaranci da aikace-aikacen ke buƙata, a cikin tsarin da yake amfani da shi da gaske. Wannan aikin ban sha’awa ne, ana iya duba shi, kuma shi ne ɓangaren da bitar lamari za ta tambaya game da shi.

Tabbatar daga yanayin da aka tura

Gwada daga rukunin ko daga aikin da ke gudana tare da ƙungiya, ƙaramin cibiyar sadarwa da matsayi ɗaya. Gazawa huɗu suna kama daga kwamfutar tafi-da-gidanka kuma ana iya bambanta su da sauƙi daga can: sunan da ba ya warwarewa, haɗin da ya ƙare, gazawar tabbatarwa ta TLS da kuma ƙin shiga rukunin bayanai. Kowanne yana nuna wata iyaka daban, kuma canza fallasar rukunin bayanai kafin sanin wanne kuke da shi hasashe ne.

psql "host=prod-db.abc123.eu-west-1.rds.amazonaws.com port=5432 dbname=app sslmode=verify-full" -c 'select 1'

Idan haɗin ya yi nasara daga rukunin kuma ya gaza daga teburinku, hanyar aikace-aikacen tana da kyau kuma hanyarku ce abin da za a gyara. Idan ya gaza daga duka biyu, fara da duban ƙungiya da hanya da ke sama maimakon takardun shaida. Wannan kwatancen ɗaya yana hana yawancin rikicin da waɗannan tikiti suke haifarwa.