---
title: "Keep databases in private subnets · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep databases in private subnets

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Rule: Put every database, cache and queue in a private subnet with no public address. Only the app's own security group may reach it.
- How: A private subnet has no route from the internet. Set the service's public access off, such as `publicly_accessible = false`. Allow the database port only from the app's security group, never from an address range. Reach it for admin work through the [admin access rule](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/no-public-admin-ports).
- Check: The query below lists no database with a public address. A connection to the database port from outside the network times out.

Example:

```hcl
resource "aws_db_instance" "orders" {
  identifier             = "shop-orders"
  publicly_accessible    = false
  db_subnet_group_name   = aws_db_subnet_group.private.name
  vpc_security_group_ids = [aws_security_group.orders_db.id]
}

resource "aws_vpc_security_group_ingress_rule" "orders_db_from_app" {
  security_group_id            = aws_security_group.orders_db.id
  referenced_security_group_id = aws_security_group.app.id
  ip_protocol                  = "tcp"
  from_port                    = 5432
  to_port                      = 5432
}
```

```sh
aws rds describe-db-instances --query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier'   # []
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/networking-and-dns/private-data-stores`.

- Next: [Deny all traffic unless a rule allows it](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/deny-by-default-firewall)
- [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)