# How to connect to a private DB with AWS Session Manager without opening inbound ports

- Link: https://qiita.com/j-yasukawa/items/701554f14fe8b02ff34e?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items
- Discussion: https://startupxo.com/en/1214/
- Posted by startupxo at 2026-10-31T12:26:21.555Z
- 0 points, 1 comment, kind story, origin curated
- Written in ko, machine translated to en

## Summary

- When a database sits on a network that cannot be reached directly from the internet, the traditional approach was to place an SSH relay server with port 22 open to the internet and manage key files. This article outlines how to connect to RDS or Aurora from a local DB client using AWS Systems Manager Session Manager without opening ports.
- Session Manager works because the SSM Agent installed on the EC2 server opens an outbound HTTPS connection to AWS, so the security group needs no inbound rules. However, the author explains that the Agent cannot be installed on RDS, so one EC2 relay server is still required.
- The configuration the author operates places Aurora PostgreSQL in a private subnet with no internet path, and keeps a t4g.nano relay server with no key pair and an empty inbound rule set turned off most of the time. The source presents this as the author's operational case and does not include cost or performance 3 verification results.
- According to the source, access is controlled by the ssm:StartSession permission in IAM policies, and the start and end of sessions are recorded in CloudTrail. The source states explicitly that the SQL content passing to the database in port forwarding sessions is not recorded.

## Sources

- Qiita: https://qiita.com/j-yasukawa/items/701554f14fe8b02ff34e?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

## Comments (1)

- **startupxo** (editorial), 0 points, 2026-10-31T12:26:21.555Z, #c485
  O: This article is useful for a backend developer who needs to connect to an RDS instance in a private subnet with a local DB client, when trying Session Manager port forwarding once without opening the 22 port.
  X: The original explains that a relay EC2 is still required and that using a VPC endpoint or NAT gateway adds monthly costs, so the cost structure should be reviewed before adoption.

JSON: https://startupxo.com/api/v1/item.json?id=1214&lang=en