IAM 数据库凭证是否足以用于公共 RDS
据我所知，将数据库服务器放在私有子网中并根据需要使用堡垒主机来访问它们是一个长期坚持的传统。但具体考虑云架构，这种设置真的有意义吗？
我很难理解的是，为什么连接到我的 RDS 服务器的可公开访问的 EC2 实例比实现 IAM 数据库身份验证的可公开访问的 RDS 实例更安全？在这两种情况下，我都会使用安全组来限制传入连接。
我正在使用 PostreSQL，根据 AWS 文档，启用 IAM 身份验证将强制执行 IAM 凭证（而对于 MySQL，我认为密码身份验证仍然有效）。
那么堡垒主机真的比 IAM 身份验证更安全吗？为什么？
I understand that it is a long upheld tradition to put your database servers in a private subnet and use a bastion host to access them as needed. But thinking specifically about cloud architecture, does that setup really make sense anymore?
What I am struggling to understand is why a publicly-accessible EC2 instance, that connects to my RDS servers, is more secure than a publicly accessible RDS instance that implements IAM Database Authentication? In both cases, I would use Security Groups to limit incoming connections.
I am using PostreSQL, and according to AWS documentation, enabling IAM authentication will enforce IAM credentials ( whereas for MySQL, I think password authentication will still work).
So is a bastion host really more secure than IAM Authentication and why?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
最好的安全性具有多层安全性。例如，如果前员工拥有数据库的凭据，他们可以从公司网络外部访问该数据库吗？或者，如果有人获得了对您堡垒的访问权限，他们是否也可以获得对数据库的访问权限？
因此，是的，可以认为它足够安全，可以使用身份验证并限制对特定 IP 地址的访问。这完全取决于您的风险偏好。如果数据库包含机密信息，而这些信息一旦泄露将使您的公司非常尴尬，那么额外的安全层可能是值得的。
The best security has multiple layers of security. For example, if an ex-staff member has credentials to the database, can they access it from outside of your corporate network? Or if somebody gains access to your bastion, can they also obtain access to the database?
So, yes, it could be considered safe enough to use authentication and to limit access to a specific IP address. It all depends upon your Risk Appetite. If the database contains confidential information that would be highly embarrassing for your company if exposed, then the additional layers of security can be worthwhile.