Hi I can t figure out how to create a database because my RD

Question

Hi I can t figure out how to create a database because my RDS server runs in private subnets How do you guys do it

quaint-eye-38036 · Answer

Wouldn t it help if you use an EC2 instance with 2 interfaces one connected to the private subnet and connected to the public subent

victorious-dusk-75271 · Answer

That will help but how do I do that with pulumi

quaint-eye-38036 · Answer

Ah ok

quaint-eye-38036 · Answer

Have you considered creating an SSH tunnel and then passing that to pulumi to create a DB in RDS

quaint-eye-38036 · Answer

If this helps <https aws amazon com premiumsupport knowledge center systems manager ssh vpc resources >

victorious-dusk-75271 · Answer

I wonder if I can start a server on AWS from CI CD and run the Pulumi from there I think this will be the best option in my opinion

quaint-eye-38036 · Answer

That s also a good option

victorious-dusk-75271 · Answer

I mean github action let you run your own worker

quaint-eye-38036 · Answer

Or <https www pulumi com docs guides automation api |Pulumi Automation API>

millions-furniture-75402 · Answer

automation api in a lambda would be the smallest footprint Bastion isn t a bad solution especially if you already have one that you can leverage but then you also have an ec2 to care about now

stocky-restaurant-98004 · Answer

There s a few options here 1 Create a VPN gateway 2 Create an EC2 instance in your VPC that has SSM Session Manager enabled much better than creating a bastion host IMO <https docs aws amazon com systems manager latest userguide session manager html>

millions-furniture-75402 · Answer

I m confused how that s not a bastion still

millions-furniture-75402 · Answer

just a bastion using the ssm proxycommand in your ssh config

victorious-dusk-75271 · Answer

| automation api in a lambda This is just to create user or run everything in there

millions-furniture-75402 · Answer

just for the provisioning of the databases on the rds

victorious-dusk-75271 · Answer

Interesting I still have to invoke the lambda function and I do not think pulumi can do that without writing a plugin or something

millions-furniture-75402 · Answer

Some related examples here <https github com pulumi automation api examples>

millions-furniture-75402 · Answer

millions-furniture-75402 · Answer

If you re more comfortable with the bastion approach <https github com pulumi automation api examples tree main nodejs ssh tunnel>

billowy-army-68599 · Answer

this is a networking problem i have a couple ways to solve it that aren t production ready yet

stocky-restaurant-98004 · Answer

< millions furniture 75402> You can open an SSH session right in the AWS console so that you don t need to manage keys or have direct network connectivity plus IAM integrated auth That s the primary advantage

stocky-restaurant-98004 · Answer

For a more robust solution I d look at what < billowy army 68599> did with Tailscale Tailscale s product is pretty impressive

millions-furniture-75402 · Answer

Right we use ssm session manager for our bastions

millions-furniture-75402 · Answer

now something like cloudshell that I could proxy through would be amazing so we wouldn t have to manage an EC2

stocky-restaurant-98004 · Answer

< millions furniture 75402> Looking for that feature in CloudShell is exactly what I did before suggesting SSM Was bummed it wasn t there When you say bastion are you allowing connections from the outside world potentially for tunneling or do you just mean bastion in the sense of a thing we spin up SSH sessions on

millions-furniture-75402 · Answer

bastion in the sense that it s a virtual machine that s running inside the VPC that we can connect to from the outside if authorized