Keep databases in private subnets

How to do it

A private subnet has no route from the internet. Set the service's public access off, such as publicly_accessible = false. Allow the database port only from the app's security group, never from an address range. Reach it for admin work through the admin access rule.

Example

resource "aws_db_instance" "orders" {
  identifier             = "shop-orders"
  publicly_accessible    = false
  db_subnet_group_name   = aws_db_subnet_group.private.name
  vpc_security_group_ids = [aws_security_group.orders_db.id]
}

resource "aws_vpc_security_group_ingress_rule" "orders_db_from_app" {
  security_group_id            = aws_security_group.orders_db.id
  referenced_security_group_id = aws_security_group.app.id
  ip_protocol                  = "tcp"
  from_port                    = 5432
  to_port                      = 5432
}

aws rds describe-db-instances --query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier'   # []

How to check

The query below lists no database with a public address. A connection to the database port from outside the network times out.