Hacker News Reader

Comment by guru4consulting | Hacker News Reader

I had assumed that this would be a HTTPS service with a public end-point, available outside a VPC. But, looks like it is still deployed inside the VPC and accessible over JDBC. Did anyone find any configuration option to deploy it outside VPC? Overall, it looks like good old Aurora RDS with an auto start/stop option, and costing based on that start/stop duration.

View on HN

Aurora requires a VPC, but you can create public subnets to allow for external access to the database.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/...

but then, placing the instance in a public subnet is also not a good idea. And moreover, JDBC connections are not optimized for serverless scenarios.. the cost of connecting/dis-connecting are too high when compared to a light-weight HTTP. And any vulnerability can be potentially exploited. I was hoping to see a true HTTP service, highly optimized for Lambda clients.

The blog post [1] provides additional insights that imply it can work well clients despite its ephemerality, and is optimized for client connection pools.

"Scaling operations are transparent to the connected clients and applications since existing connections and session state are transferred to the new nodes."

As for the public subnet concern, you can apply security groups to your database instance to ensure only authorized CIDR ranges can call it. Additionally, you can use IAM authentication [2] for DB callers (only recommended for light-weight applications with low concurrency),

[1] https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Using...

[2] https://aws.amazon.com/blogs/aws/aurora-serverless-ga

VPC only for now

Reply on news.ycombinator.com