Securely Connecting an Application to RDS and Cross-Account Access

// The app connects over a private endpoint inside the VPC
package com.bank.persistence;

import java.sql.Connection;
import java.sql.DriverManager;

public class PrivateRdsConnection {
    // Private endpoint: no public IP, no internet access
    private static final String URL =
        "jdbc:postgresql://nbi-ledger.abcdef.ap-south-1.rds.amazonaws.com:5432/ledger"
        + "?ssl=true&sslmode=verify-full";

    public Connection connect(String user, String password) throws Exception {
        return DriverManager.getConnection(URL, user, password);
    }
}

// Security group rule concept
package com.bank.infrastructure;

public class SecurityGroupRule {
    private final String direction;      // "inbound"
    private final int port;              // 5432
    private final String sourceType;     // "security-group"
    private final String sourceValue;    // "sg-0app123"

    public SecurityGroupRule(String direction, int port, String sourceType, String sourceValue) {
        this.direction = direction;
        this.port = port;
        this.sourceType = sourceType;
        this.sourceValue = sourceValue;
    }

    public void explain() {
        System.out.println("Allow " + direction + " on port " + port);
        System.out.println("Source: " + sourceType + " = " + sourceValue);
        System.out.println("Only resources in sg-0app123 can reach the database");
    }
}

// Fetching rotated credentials from Secrets Manager
package com.bank.persistence;

import software.amazon.awssdk.services.secretsmanager.SecretsManagerClient;
import software.amazon.awssdk.services.secretsmanager.model.GetSecretValueRequest;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.util.Map;

public class RotatedCredentialProvider {
    private final SecretsManagerClient sm = SecretsManagerClient.create();
    private final ObjectMapper mapper = new ObjectMapper();

    public Map<String, String> getCredentials() throws Exception {
        String secretJson = sm.getSecretValue(
            GetSecretValueRequest.builder()
                .secretId("prod/nbi-ledger/credentials")
                .build()
        ).secretString();
        return mapper.readValue(secretJson, Map.class);
        // Returns {"username": "admin", "password": "rotated-value"}
    }
}

// Generating an IAM auth token for RDS
package com.bank.persistence;

import software.amazon.awssdk.services.rds.RdsUtilities;
import software.amazon.awssdk.services.rds.model.GenerateAuthenticationTokenRequest;
import software.amazon.awssdk.regions.Region;

public class IamAuthProvider {
    public String generateToken() {
        RdsUtilities utilities = RdsUtilities.builder()
            .region(Region.AP_SOUTH_1).build();
        return utilities.generateAuthenticationToken(
            GenerateAuthenticationTokenRequest.builder()
                .hostname("nbi-ledger.abcdef.ap-south-1.rds.amazonaws.com")
                .port(5432)
                .username("iam_user")
                .build());
    }
}

// Connection URL forcing TLS with certificate verification
package com.bank.persistence;

public class TlsConnectionConfig {
    // sslmode=verify-full: verify server cert AND hostname
    private static final String URL =
        "jdbc:postgresql://nbi-ledger.abcdef.ap-south-1.rds.amazonaws.com:5432/ledger"
        + "?ssl=true&sslmode=verify-full&sslrootcert=/opt/certs/rds-combined-ca-bundle.pem";

    public void explain() {
        System.out.println("ssl=true: force encrypted connection");
        System.out.println("sslmode=verify-full: verify certificate AND hostname");
        System.out.println("sslrootcert: path to the RDS CA bundle");
    }
}

// Cross-account access setup summary
package com.bank.infrastructure;

public class CrossAccountRdsAccess {
    public static void printSteps() {
        System.out.println("Step 1: Network connectivity");
        System.out.println("  - VPC peering, PrivateLink, or Transit Gateway");
        System.out.println();
        System.out.println("Step 2: Security group");
        System.out.println("  - DB SG in account B allows source from account A");
        System.out.println("  - With peering: can reference peer SG or allow CIDR");
        System.out.println();
        System.out.println("Step 3: Authentication");
        System.out.println("  - IAM auth: account A assumes cross-account role");
        System.out.println("  - Secrets Manager: resource policy shares secret");
    }
}

// Decision helper for network connectivity
package com.bank.infrastructure;

public class CrossAccountNetworkDecision {
    public static String recommend(int servicesNeeded) {
        if (servicesNeeded == 1) {
            return "PrivateLink: expose exactly one endpoint, minimal blast radius";
        }
        return "VPC Peering or Transit Gateway: many services need connectivity";
    }
}

// Wrong vs Correct security group configuration
package com.bank.infrastructure;

public class SecurityGroupMistakes {
    public static void showMistakes() {
        System.out.println("WRONG: Allow 5432 from 0.0.0.0/0");
        System.out.println("  Anyone on the internet can attempt to connect");
        System.out.println();
        System.out.println("WRONG: Allow 5432 from 10.0.0.0/16");
        System.out.println("  Entire VPC CIDR, too broad");
        System.out.println();
        System.out.println("CORRECT: Allow 5432 from sg-0app123");
        System.out.println("  Only resources in the app security group");
    }
}