October 3, 2026 路 #17
Postgres with a public address
The database is in a private subnet, or so the module claims. What still exposes it?
resource "aws_db_instance" "app" {
identifier = "app"
engine = "postgres"
instance_class = "db.t4g.small"
db_subnet_group_name = aws_db_subnet_group.app.name
vpc_security_group_ids = [aws_security_group.db.id]
publicly_accessible = true
username = "app"
password = var.db_password
skip_final_snapshot = true
}Next puzzle in UTC
One try. The first answer sticks.
How to fix it
publicly_accessible true gives the instance a public IP and a public DNS name. Set it to false and restrict the security group to the application subnets.
A subnet group named "private" does not make the database private. publicly_accessible = true asks AWS for a public IP and a public DNS record. If any subnet in the group has a route to an internet gateway, the instance is reachable from the internet, subject only to the security group. People then "temporarily" open 5432 to 0.0.0.0/0 to debug a connection, and the temporary rule stays.
skip_final_snapshot = true is a footgun for deletes. It is not the exposure. The password in a Terraform variable is a second problem if that variable lands in state in clear text, which it does. Use a managed secret and manage_master_user_password, and lock the state bucket down. Do that after you remove the public address.
Fix
publicly_accessible = false
Point the security group at the application security group, not a CIDR. Connect from a laptop through SSM port forwarding. Add an AWS Config rule for rds-instance-public-access-check so the next module that defaults this to true fails in the account, not only in review.