--- title: How to Make your Amazon RDS DB Private if it’s Already Public description: Be aware of having a public accessible DB! The following post will guide you on how to migrate a public RDS DB to be private without losing any data. image: https://blog.nexton.dev/hubfs/Nxt%20Blog%20modying%20a%20public.png --- [![Nexton Hubspot](https://blog.nexton.dev/hubfs/Nexton%20Hubspot.png)](https://nexton.dev/) [About](https://www.nexton.dev/about) [Contact](https://www.nexton.dev/#letsTalk) [For Talent](https://www.nexton.dev/talent) [For Companies](https://www.nexton.dev/) - Menu Item 1 - Sub-menu Item 1 - Another Item - Sub-menu Item 2 - Menu Item 2 - Yet Another Item - Menu Item 3 - Menu Item 4 [ABOUT](https://www.nexton.dev/about) [CONTACT](https://www.nexton.dev/#letsTalk) [FOR TALENT](https://www.nexton.dev/talent) [FOR COMPANIES](https://www.nexton.dev/) [Technology](https://blog.nexton.dev/tag/technology) - [HIPAA](https://blog.nexton.dev/tag/hipaa) - Sun Oct 4 2020 # How to Make your Amazon RDS DB Private if it’s Already Public [![Fabricio Pautasso](https://blog.nexton.dev/hubfs/federico%20pata.png) Fabricio Pautasso](https://blog.nexton.dev/author/fabricio-pautasso) When you start using AWS RDS, you might end up creating a new database that is publicly accessible to start playing with it quickly. When it comes to security, having a public accessible DB is a bad idea. So, in this guide, we will show you, how to migrate a public RDS DB to be private without losing any data. [![Migrating an AWS RDS public to an RDS DB private](https://images.ctfassets.net/k4d8pgyc7rbq/cAjEvWoYJNGIwgalrJ12X/8cc48e3f92fb8c5a2d880dae1d73bd06/vpc.png)](https://images.ctfassets.net/k4d8pgyc7rbq/cAjEvWoYJNGIwgalrJ12X/8cc48e3f92fb8c5a2d880dae1d73bd06/vpc.png) ## Problem > We have an API deployed to Amazon EC2 that is using a RDS Database that was created publicly accessible and we want to make it private. ## Solution Create a new route table without internet gateway association. Go to **VPC → Route Tables** Put a descriptive name to the Route Table created to identify it [![Creating a Route Table in the VPC dashboard](https://images.ctfassets.net/k4d8pgyc7rbq/3rfhvK5hvm51TWbxH9U6KP/34b58ff7a8b071ddd2c3281c6b3017bc/tables.png)](https://images.ctfassets.net/k4d8pgyc7rbq/3rfhvK5hvm51TWbxH9U6KP/34b58ff7a8b071ddd2c3281c6b3017bc/tables.png) Create two new subnets and add them to the route table created in the previous step. Go to **VPC → Subnets** If you don’t know how to setup Subnet CIDR, verify the pattern that is being used on the other subnets. For further information you can read [this post](https://treyperry.com/2015/06/22/ipv4-cidr-vpc-in-a-nutshell/#targetText=From%20there%2C%20choose%20the%20%E2%80%9CSubnets,a%20single%20AWS%20availability%20zone). [![Create subnets and add them to Route Table](https://images.ctfassets.net/k4d8pgyc7rbq/6j51XU8c8L2q9c9LDmJ6q9/f81f60f1d72eba934788a52ff4b31485/subnets.png)](https://images.ctfassets.net/k4d8pgyc7rbq/6j51XU8c8L2q9c9LDmJ6q9/f81f60f1d72eba934788a52ff4b31485/subnets.png) - Go to **RDS → Subnet groups** and create a new subnet group with the just created subnets After this step if you try to associate the new subnet group to your RDS DB you will receive the following error: > You cannot move DB instance XXX to subnet group XXX. The specified DB subnet group and DB instance are in the same VPC. Choose a DB subnet group in different VPC than the specified DB instance and try again. (Service: AmazonRDS; Status Code: 400; Error Code: InvalidVPCNetworkStateFault; Request ID: 7d46c84c-b22a-11e6-be20-b5bb6bd6cc6d) [![Error message](https://images.ctfassets.net/k4d8pgyc7rbq/1ebgcVdvfuCaQ8tmtZDKEM/5a695ab3b4f046d9fca5f07746101ff8/workaround.png)](https://images.ctfassets.net/k4d8pgyc7rbq/1ebgcVdvfuCaQ8tmtZDKEM/5a695ab3b4f046d9fca5f07746101ff8/workaround.png) **Workaround for previous error:** - Create temporal VPC. Set the VPC CIDR to 172.16.0.0/16. - Create two new temporal Subnets for the new Temp VPC. You can use the below examples: - Private1 in us-east-1a: 172.16.1.0/24 - Private2 in us-east-1b: 172.16.2.0/24 - Go to RDS and create a new temporal Subnet group with the just created subnets - Modify the RDS DB instance to reside in the new Subnet group created for the new VPC - After changes are completed. Modify RDS DB instance again to point to Subnet group created in step 3 - Test API is still working - Clean up temporal VPC/Subnets/Subnets group created. - Go to VPC → Select temporal VPC and delete it. (It will remove all associated assets) **Be careful with this last step, as you can delete unwanted VPC** ## Connect to private DB from DB Tool As the DB is private now, the only way that a developer can connect to the DB for development purposes is using a tunnel connection from another AWS accessible asset. In this case, we will use the EC2 machine where the application is deployed to establish an SSH tunnel to the DB - Go to EC2 -> Key Pairs and create a new key pair for the application - Go to your elastic beanstalk environment, Configuration -> Security - Add the created key pair to the environment and apply changes - Environment will replace the EC2 instance and restart - Test BE API is working - Go to your DB Tool and configure the ssh tunnel connection - In host put the EC2 IP address - Port 22 - User name -> ec2-user - Auth method -> Public Key -> Add the pem file for the EC2 machine - Test the connection. [![test-connection](https://images.ctfassets.net/k4d8pgyc7rbq/4d5nFf1340klIzHMHKqBVb/f927a421940ba70bd801ec01b84b1f1b/test-connection.png)](https://images.ctfassets.net/k4d8pgyc7rbq/4d5nFf1340klIzHMHKqBVb/f927a421940ba70bd801ec01b84b1f1b/test-connection.png) *Troubleshooting tip. If it fails to connect, check the **security group** of the **EC2** machine to verify that the DB port is allowed.*       More on [Technology](https://blog.nexton.dev/tag/technology) - [HIPAA](https://blog.nexton.dev/tag/hipaa) [![Fabricio Pautasso](https://blog.nexton.dev/hubfs/federico%20pata.png)](https://blog.nexton.dev/author/fabricio-pautasso) WRITTEN BY [Fabricio Pautasso](https://blog.nexton.dev/author/fabricio-pautasso) **Lead Engineer** I’m interested in challenging projects that allows me to work with emerging technologies. [Back to the blog](https://blog.nextonlabs.com/) Recent Posts ## [LATAM Tech Salaries in 2026: What the Data Actually Shows](https://blog.nexton.dev/latam-tech-salaries-in-2026-what-the-data-actually-shows) ## [The $100K H-1B Visa Solution for U.S. Companies](https://blog.nexton.dev/the-100k-visa-solution) ## [From Talent to Traction: How Nearshore Teams Help Startups Move Faster](https://blog.nexton.dev/how-nearshore-teams-help-startups-move-faster) Share It! ![sanity](https://blog.nexton.dev/hubfs/sanity.png) ## 2023 Latin American Tech Salaries and Benefits Trends report [Unlock insights](https://talent.nextonlabs.com/tech-salaries-and-benefits-trends-report/) ### Our latest posts straight to your inbox: [Copyright © Nexton 2021 - ALL RIGHTS RESERVED.](https://www.nextonlabs.com/privacy-policy/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Fabricio Pautasso", "url" : "https://blog.nexton.dev/author/fabricio-pautasso" }, "dateModified" : "2023-07-06T15:11:10.370Z", "datePublished" : "2020-10-04T14:45:00.000Z", "headline" : "How to Make your Amazon RDS DB Private if it’s Already Public", "image" : [ "https://blog.nexton.dev/hubfs/Nxt%20Blog%20modying%20a%20public.png" ], "mainEntityOfPage" : { "@id" : "https://blog.nexton.dev/how-to-make-your-amazon-rds-db-private-if-its-already-public", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.nexton.dev/hubfs/Nexton%20Hubspot.webp" }, "name" : "Nexton" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://nexton.dev/#organization", "@type" : "Organization", "areaServed" : { "@type" : "Country", "name" : "United States" }, "description" : "Nexton is a nearshore tech staffing company connecting US companies with LATAM engineers. Every candidate is technically vetted by another engineer — not a recruiter, not an algorithm — before joining the network. Matched candidates arrive within 72 hours; average time-to-hire is 4 weeks. Nexton has completed 1,500+ placements for 350+ US companies, with deep experience in HealthCare, Insurance, and E-Learning.", "disambiguatingDescription" : "Nearshore technology staffing company serving US companies with engineers from Latin America. Not affiliated with Nexton, the residential real estate development in Summerville, South Carolina, nor with Nexton, the technology company based in France.", "foundingLocation" : { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "AR" } }, "knowsAbout" : [ "Nearshore tech staffing", "Engineer-to-engineer technical vetting", "LATAM software engineer hiring", "Remote engineering team building", "LATAM tech compensation data" ], "logo" : { "@id" : "https://nexton.dev/#logo", "@type" : "ImageObject", "caption" : "Nexton", "url" : "https://nexton.dev/Nexton/NextonLogo.svg" }, "name" : "Nexton", "sameAs" : [ "https://www.linkedin.com/company/nexton/", "https://www.facebook.com/nextontalent/", "https://twitter.com/nexton/", "https://www.instagram.com/nexton.dev/", "https://www.crunchbase.com/organization/nexton-b25a", "https://clutch.co/profile/nexton", "https://www.wikidata.org/wiki/Q140867481" ], "slogan" : "Nearshore engineers, vetted by engineers — not algorithms, not recruiters.", "url" : "https://nexton.dev/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://nexton.dev/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "Nexton", "publisher" : { "@id" : "https://nexton.dev/#organization" }, "url" : "https://nexton.dev/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://nexton.dev/#diego-sternberg", "@type" : "Person", "jobTitle" : "Co-Founder & CEO", "name" : "Diego Sternberg", "sameAs" : [ "https://www.linkedin.com/in/diegosternberg" ], "worksFor" : { "@id" : "https://nexton.dev/#organization" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://nexton.dev/#lucas-arana", "@type" : "Person", "jobTitle" : "VP of Talent", "name" : "Lucas Arana", "sameAs" : [ "https://www.linkedin.com/in/lucasarana" ], "worksFor" : { "@id" : "https://nexton.dev/#organization" } } ```