AWS RDS Database with VPC and Bastion Host

This Terraform configuration creates a secure, production-ready AWS infrastructure with:

• VPC with public, private, and database subnets across multiple AZs
• RDS MySQL database instance in private subnets with Multi-AZ deployment
• Bastion Host for secure database access
• Security Groups with proper network isolation
• NAT Gateway for outbound internet access from private subnets

Architecture

┌─────────────────────────────────────────────────────────────┐
│                        VPC (10.0.0.0/16)                   │
├─────────────────────┬───────────────────────────────────────┤
│   Public Subnets    │            Private Subnets           │
│                     │                                       │
│  ┌─────────────┐    │  ┌─────────────┐  ┌─────────────────┐ │
│  │ Bastion     │    │  │ NAT Gateway │  │ Database Subnets│ │
│  │ Host        │────┼──│             │  │                 │ │
│  │             │    │  │             │  │ ┌─────────────┐ │ │
│  └─────────────┘    │  └─────────────┘  │ │ RDS MySQL   │ │ │
│                     │                   │ │ Multi-AZ    │ │ │
│                     │                   │ └─────────────┘ │ │
│                     │                   └─────────────────┘ │
└─────────────────────┴───────────────────────────────────────┘

Project Structure

.
├── terraform/                 # Main Terraform configuration
│   ├── versions.tf            # Terraform and provider versions
│   ├── variables.tf           # Input variables
│   ├── locals.tf              # Local values
│   ├── vpc.tf                 # VPC configuration
│   ├── bastion.tf             # Bastion host configuration
│   ├── rds.tf                 # RDS database configuration
│   ├── outputs.tf             # Output values
│   ├── terraform.tfvars.example  # Example variables file
│   └── secrets.tfvars.example    # Example secrets file
├── examples/                  # Usage examples (future)
├── .gitignore                # Git ignore rules
└── README.md                 # This file

Prerequisites

• Terraform >= 1.6
• AWS CLI configured with appropriate credentials
• An existing EC2 Key Pair in your AWS account

Quick Start

1. Clone the repository

   git clone https://github.com/Benjamincode-24/benji-aws-terraform.git
   cd benji-aws-terraform

2. Navigate to terraform directory

   cd terraform

3. Configure variables

   # Copy example files
   cp terraform.tfvars.example terraform.tfvars
   cp secrets.tfvars.example secrets.tfvars
   
   # Edit with your values
   # Update terraform.tfvars with your configuration
   # Update secrets.tfvars with your database credentials

4. Deploy infrastructure

   terraform init
   terraform plan -var-file="secrets.tfvars"
   terraform apply -var-file="secrets.tfvars"

Configuration

Required Variables (secrets.tfvars)

Variable	Description	Example
db_username	Database administrator username	dbadmin
db_password	Database administrator password	SecurePassword123!

Optional Variables (terraform.tfvars)

Variable	Description	Default
aws_region	AWS region	us-east-1
environment	Environment name	dev
instance_type	EC2 instance type	t3.micro
instance_keypair	EC2 Key Pair name	benskeypair
db_instance_class	RDS instance class	db.t3.micro

Important Outputs

After deployment, note these important outputs:

• bastion_public_ip: Public IP address for SSH access to bastion host
• rds_endpoint: Database endpoint for application connections
• vpc_id: VPC ID for reference

Connecting to the Database

1. SSH to Bastion Host

   ssh -i your-key.pem ec2-user@<bastion_public_ip>

2. Install MySQL client on bastion

   sudo yum update -y
   sudo yum install mysql -y

3. Connect to RDS

   mysql -h <rds_endpoint> -u <db_username> -p

Security Features

• ✅ Database in private subnets (no direct internet access)
• ✅ Access only through bastion host
• ✅ Security groups with minimal required access
• ✅ Multi-AZ deployment for high availability
• ✅ Encrypted storage and backups
• ✅ Performance Insights enabled
• ✅ CloudWatch logging enabled

Cost Optimization

• Uses t3.micro instances (Free Tier eligible)
• Single NAT Gateway to reduce costs
• db.t3.micro RDS instance (Free Tier eligible)
• Configurable storage with auto-scaling

Cleanup

To destroy the infrastructure:

terraform destroy -var-file="secrets.tfvars"

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Test thoroughly
5. Submit a pull request

License

This project is licensed under the MIT License.

Support

For issues and questions, please open an issue in the GitHub repository.