I have an RDS in a public subnet in my default VPC. It's set to "Public accessibility: Yes". Its VPC security groups allow inbound access from a couple of CIDR blocks (basically, our office and VPN IP's) and a Lambda function.
I can connect to this database from anywhere, and I don't want to be able to.
My assumption was that, while "Public accessibility" would give it an external IP and domain, the security group restrictions would still apply: I could try to connect to myrdsdatabase.eu-west-1.rds.amazonaws.com
but, unless I was on one of the whitelisted security group IPs, the connection would be refused. From the docs:
["Public accessibility"] lets you designate whether there is public access to the DB instance. Access to the DB instance is ultimately controlled by the security group it uses, and that public access is not permitted if the security group assigned to the DB instance does not permit it.
Am I misreading the above, or have I simply applied the security groups wrong? How do I allow RDS access from a whitelist of external IPs?