I-RDS eyimfihlo isuka ku-EC2: i-VPC efanayo, peering noma okunye?

I-laptop yomthuthukisi ifinyelela isimo se-RDS esiyimfihlo ngokusebenzisa i-VPN yabasebenzi, kodwa uhlelo lokusebenza ku-EC2 alukwazi ukuxhuma nhlobo. Lokhu akukona ukuthunyelwa okuphukile. I-laptop inomhubhe isimo se-EC2 esingakaze sisithole njengefa, futhi «eyimfihlo» ku-RDS kusho ukuthi isizindalwazi asinayo indawo yokugcina evamile, hhayi ukuthi abasebenzisi be-VPN abangabantu yibona kuphela abavunyelwe ukushaya ucingo. Uhlelo ludinga umzila walo ogunyaziwe, ubudlelwano balo neqembu lokuphepha kanye nobunikazi balo esizindalwazini, futhi ukulandelana okukhetha ngakho lezi zinto ezintathu konga ingxenye enkulu yokulungisa amaphutha. Thatha isinqumo ngomzila kuqala, bese kuba yimvume, bese uqinisekisa kusuka endaweni esetshenzisiwe hhayi etafuleni lakho.

I-VPN ye-laptop akuwona umzila wohlelo

Noma yini i-VPN yabasebenzi eyenzayo kubantu, ayenzanga lutho esimweni ngaphandle uma leso simo siyingxenye ecacile yomzila ofanayo wenethiwekhi. Isimo se-EC2 kusubneti eyimfihlo sifinyelela i-RDS ngokusebenzisa ukuhamba kwe-VPC, amaqembu okuphepha kanye nama-ACL enethiwekhi. Asiwutholi njengefa umhubhe womuntu, isikhathi somuntu noma ubufakazi bomuntu, futhi akufanele: ukuxhumana kohlelo okungagadiwe kanye nokufinyelela kude kwabasebenzi kufanele kusebenze ngokuzimela.

Lokho kuzimela kuyisici. Uma i-VPN yehla, uhlelo luqhubeka lusebenza. Uma uhlelo luziphatha kabi, akekho olahlekelwa ukufinyelela kwakhe kude. Amadizayini ahlanganisa kokubili kumzila owodwa ngokuvamile atholakala phakathi nesehlakalo, ngesikhathi esibi kakhulu.

Isinqumo 1: i-VPC efanayo, umzila oqondile

Uma uhlelo kanye nesizindalwazi kukhona ku-VPC efanayo ngokuhamba okuqondile futhi kungekho khithi yokuhlola phakathi kwazo, umzila ulula futhi inkomba yeqembu lokuphepha iyithuluzi elinamandla kakhulu elitholakalayo. Nika uhlelo iqembu lalo, bese uvumela imbobo yesizindalwazi kusuka kulelo qembu hhayi kusuka ebangeni lamakheli:

aws ec2 authorize-security-group-ingress --group-id sg-0db123   --protocol tcp --port 5432 --source-group sg-0app456

aws rds describe-db-instances --db-instance-identifier prod-db   --query 'DBInstances[0].{Endpoint:Endpoint.Address,Port:Endpoint.Port,Public:PubliclyAccessible,Groups:VpcSecurityGroups}'

Imbobo iyisibonelo futhi kufanele ihambisane nenjini. Inkomba yeqembu igunyaza ithrafikhi evela ezimweni zohlelo; ayikopishi imithetho yazo futhi ayidali ukungena kwesizindalwazi. Izinkinga ezimbili ezahlukene, izixazululo ezimbili ezahlukene.

Bese uhlola ingxenye esele yomzila esikhundleni sokuma kumthetho osona ukwengeza. Inqubomgomo yokuphuma yohlelo, isethi ephelele yamaqembu anamathele esizindalwazini, amathebula omzila wesubneti kanye nanoma yimaphi ama-ACL enethiwekhi kufanele kuvumelane. Imithetho yeqembu lokuphepha inesimo, kanti i-ACL yenethiwekhi yangokwezifiso kufanele ivume isicelo kanye nethrafikhi ebuyayo emithethweni ehlukene, kufaka phakathi izimbobo zesikhashana. Umthetho omusha omncane wesizindalwazi awuwuqedi umthetho wakudala obanzi owawunamathiselwe.

Isinqumo 2: enye i-VPC noma enye i-akhawunti

Uma uhlelo lukwi-VPC enye, abanikazi benethiwekhi bakhetha ukuxhumana okuyimfihlo okusekelwayo: peering, idizayini yokudlula noma ilungiselelo le-VPC eyabiwe. Khona-ke zombili izinhlangothi zokuhamba kufanele zibe khona, ukuxazululwa kwamagama kufanele kusebenze endaweni yokugcina ye-RDS, futhi umthombo ohlolwa inqubomgomo yesizindalwazi kufanele uhambisane nalokho okufikayo ngempela. Amagama e-akhawunti afanayo noma ubudlelwano bokukhokha obabiwe akunikezi lutho kwalokhu.

Inkomba yeqembu lokuphepha iyingxenye eshintshayo. Isebenza emadizayini amaningi okuxhumana okuyimfihlo, kodwa iyeka ukusebenza ngesikhathi ibhokisi eliphakathi libhala kabusha umthombo noma liqeda ukuxhumana, ngoba isizindalwazi sibona ibhokisi eliphakathi hhayi iqembu lakho lohlelo. Izimo ze-VPC ze-RDS zihlukanisa ukufinyelela ngaphakathi kwe-VPC efanayo kusuka kwezinye izilungiselelo, futhi kufanele uhlole i-topology yakho ethile kuzo ngaphambi kokucabanga ukuthi isitayela somthetho siyadlula.

Ungaxazululi umzila ongekho ngokwenza isizindalwazi sifinyeleleke emphakathini. Leso yisinqumo esihlukile sokuchayeka esinomnikazi ohlukile, futhi ngokuvamile sisikiselwa yilowo okude kakhulu nomphumela.

Isinqumo 3: yibuphi ubunikazi isizindalwazi esikwamukelayo

Ukufinyelela kwenethiwekhi nokuqinisekisa kwesizindalwazi kuyizingqimba ezahlukene, futhi ukuzihlanganisa kudala amaphutha adukisa kakhulu. Indima yesimo ingubunikazi be-AWS bokushaya izingcingo ze-AWS API. Akusona umsebenzisi wesizindalwazi. Ukuqinisekiswa kwesizindalwazi nge-IAM kuyisici esisekelwayo lapho injini nokucushwa kuvuma khona, futhi kuseyimephu yomsebenzisi wesizindalwazi, hhayi indawo yakhe.

Sebenzisa igama lendawo yokugcina ye-RDS ekucushweni kohlelo esikhundleni sekheli elithathwe osukwini olulodwa. Ukushintshwa kwe-Multi-AZ kushintsha ikheli elingemuva kwalelo gama, futhi uhlelo oluboshelwe ku-IP luzohluleka ngaso sona sikhathi lapho ludingeka khona. Shiya ukuqinisekiswa kwe-TLS kwenjini kuvuliwe esikhundleni sokukucisha ukuze iphutha linyamalale, ngoba ukuhluleka kokuqinisekisa kukutshela okuthile mayelana nendawo yokugcina oyifinyelele.

Bese unikeza i-akhawunti yesizindalwazi ubuncane obudingwa uhlelo, kusikimu esilusebenzisa ngempela. Lowo msebenzi uyisicefe, uyahlolwa, futhi uyingxenye okuzobuzwa ngayo ukubuyekezwa kwesehlakalo.

Qinisekisa kusuka endaweni esetshenzisiwe

Hlola kusuka esimweni noma kusuka emsebenzini ogijima neqembu, isubneti nendima efanayo. Ukwehluleka okune kubukeka kufana kusuka ku-laptop futhi kulula ukukuhlukanisa kusuka lapho: igama elingaxazululeki, ukuxhumana okuphelelwa isikhathi, ukwehluleka kokuqinisekisa kwe-TLS kanye nokungena kwesizindalwazi okunqatshiwe. Ngakunye kukhombisa umngcele ohlukile, futhi ukushintsha ukuchayeka kwesizindalwazi ngaphambi kokwazi ukuthi yikuphi onakho kuwukuqagela.

psql "host=prod-db.abc123.eu-west-1.rds.amazonaws.com port=5432 dbname=app sslmode=verify-full" -c 'select 1'

Uma ukuxhumana kuphumelela kusuka esimweni futhi kwehluleka kusuka etafuleni lakho, umzila wohlelo ulungile futhi ukufinyelela kwakho yikho okudinga ukulungiswa. Uma kwehluleka kuzo zombili, qala ngokuhlolwa kweqembu nomzila okungenhla esikhundleni sobufakazi. Lokho kuqhathanisa okukodwa kuvimbela ingxenye enkulu yothuthu oludalwa yilawa mathikithi.