noob question - how can I securely connect RDS using node-mysql2?

[Nithur-M]

I know connecting via the provided endpoint is not safe since it will open up connections to the whole internet. What is the best way to connect to the db on RDS to my node app hosted somewhere else?
I see using SSH is an option but node-mysql2 don't have any ability to connect that way. Please help. Thanks.

[sidorares]

the easiest way is to use ssl encrypted connection that mysql protocol suports

In order to enable it, you pas ssl key as a createConnection option ( or as a parameter in a connection url ), documentation is here

In case of AWS RDS you can use a string value as an alias to bundled ssl options configuration, example:

const conn = mysql.createConnection({
  // username, password, etc
  ssl: "Amazon RDS"
});

another option is to have ssh server on the same box as mysql client and tunnel it, for example using ssh2 library
see example code here: https://stackoverflow.com/a/30669454/705115

[Nithur-M]

Hey @sidorares, thanks for the help.
For the first method, I still have to open the connection for the internet right? to be able to be accessed from anywhere? is that safe?

[sidorares]

yes, db ip/port needs to be accessible for your client source ip range. With ssl the communication is encrypted, and there are currently no known vulnerabilities for mysql_native_password or mysql_caching_sha2_password auth methods afaik but please do your own research, thats just my opinion :) Companies like https://planetscale.com/ offer hosted db solution where connecting to a db over the internet is a recommended practice so it's probably OK

[Nithur-M]

hello @sidorares, is it possible to use promise wrapper in this method?

another option is to have ssh server on the same box as mysql client and tunnel it, for example using ssh2 library
see example code here: https://stackoverflow.com/a/30669454/705115

[sidorares]

yes, promise createConnection takes exactly same parameters as a non-promise

node-mysql2/promise.js

Line 251 in afaa048

const coreConnection = core.createConnection(opts);

so you can pass stream to it

[Nithur-M]

const connection = mysql.createConnection(updatedDbServer); connection.connect((error) => { if (error) { console.log("error---", error); reject(error); } console.log("Connection Successful"); resolve(connection); });
When I pass stream to the createConnection (promise wrapper) function, it is throwing an error connection.connect is not a function. Why?

[sidorares]

promise createConnection does not have .connect() on it and resolves only once connection is established

[Nithur-M]

@sidorares Thanks for the help.