PrivateLink with RDS

​

Overview

​

Create using Control Plane Terraform

​

Modes

1. Create New Infrastructure (default)
   • RDS, Secret Manager Secret and VPC infrastructure will be created along with networking resources.
2. Existing Infrastructure
   • Uses your preexisting RDS, Secret Manager Secret and VPC infrastructure to create networking resources.
   • To use this mode, you must provide your RDS ARN and Secret Manager Secret ARN.

​

What’s Created

​

Prerequisites

• Install AWS CLI.
• Install Terraform CLI version 1.11.1 or later.
• Git (for cloning the repository).

• Amazon Web Service (AWS) account with billing enabled.
• AWS IAM User/Role with appropriate permissions (VPC, RDS, Lambda, NLB, Secrets Manager, IAM, CloudWatch, etc.).
• Deploy resources in the same region as your Control Plane workload.

• VPC, subnets, and RDS infrastructure already created and available.
• Create Secrets Manager Secret with database credentials in the following JSON format.
  {
  "username": "your_db_username",
  "password": "your_db_password"
  }
  
• Your RDS instance’s security group must allow inbound PostgreSQL traffic (port 5432) from the VPC CIDR, so the RDS Proxy created by the Terraform can reach the database.

​

Step 1 - Clone Control Plane Terraform

git clone https://github.com/controlplane-com/cpln-rds-producer
cd cpln-rds-producer

• This repository contains Terraform modules for provisioning AWS infrastructure that integrates with Control Plane via PrivateLink.

​

Step 2 - Create Configuration File

• Create a terraform.tfvars file in the root of the cloned repository.
• For using Create New Infrastructure mode:
  terraform.tfvars

  aws_region = "us-west-2"
  db_username = "postgres"
  db_password = "SecurePassword123!"
  
• For using Existing Infrastructure mode:
  terraform.tfvars

  db_instance_arn = "arn:aws:rds:us-west-2:123456789012:db:my-db"
  secret_arn = "arn:aws:secretsmanager:us-west-2:123456789012:secret:my-secret"
  

​

Step 3 - Deploy Infrastructure

• Run the Terraform with your configuration:

terraform init
terraform plan
terraform apply

• The Terraform will automatically provision all necessary resources and output your PrivateLink endpoint service name.

• For more information, refer to the repository README

​

Next Steps

• Contact support@controlplane.com with your service name and region.
• Control Plane will use this to create the consumer-side endpoint connection.
• No manual acceptance is required: the endpoint service is created with automatic acceptance enabled and only allows connections from Control Plane’s AWS account (the allowed_principal_arn variable).
• Proceed to follow the Native Networking Setup in Control Plane.

​

Connecting to the Database

• TLS is required. The RDS Proxy is configured with require_tls, so clients must connect with SSL enabled (e.g., sslmode=require for PostgreSQL clients).
• Authenticate using the database username and password stored in the Secrets Manager Secret.
• Connect to the PrivateLink endpoint on port 5432.