LAA Modernisation Platform to Cloud Platform DB connectivity

[zerj9]

Service name

namespace: laa-data-claims-data-factory-uat

Service environment

• Dev / Development
• Staging
• Prod / Production
• Other

Impact on the service

Unable to connect to data source to ingest data into the LAA Data Factory account

Problem description

Cannot connect to the RDS Postgres database in the cloud platform account from the LAA Data Factory Mod Platform test account.

The network firewall has a PASS rule to allow traffic to flow through the transit gateway. The security groups have been updated to also allow traffic flow.

DNS resolution is successful from an EC2 in the Data Factory account but a connection attempt to the database times out.

Contact person

Serj Hassan on Slack

[SimonPPledger]

Dave to check IP address used by RDS

[davidkelliott]

RDS Instance IP - 172.20.97.28

Known unreachable IP range - 172.20.32.0/24
(172.20.32.0 – 172.20.32.255)

So this is not in the known un-routable range

[FolarinOyenuga]

Hi zerj9 ,

Having looked through your namespace, the connection timeout is a Cloud Platform side config gap in your namespace.

You already defined the correct security group for this, laa-data-claims-data-factory-uat-rds-sg, which allows inbound 5432 from your MP range 10.26.96.0/21: https://github.com/ministryofjustice/cloud-platform-environments/blob/772b5e204c60c67730616ef42a3aa3ad82ec22e6/namespaces/live.cloud-platform.service.justice.gov.uk/laa-data-claims-data-factory-uat/resources/security-group.tf#L9

The problem is it was never attached to the RDS instance, so your traffic gets dropped. To fix it, add this line to your RDS module:
vpc_security_group_ids = [aws_security_group.rds.id]

Please raise a PR with that change and post it in the #ask-cloud-platform channel for review. Once it is merged and applied, please retry the connection from the Data Factory side and let us know how it goes.

[zerj9]

Oh no, feel a bit silly for missing that. Thanks for looking into it.

[FolarinOyenuga]

They have now established connection after attaching the pre-defined security group to their database.