The typical security setup would be:
- A Security Group on the Amazon EC2 instances created by Elastic Beanstalk (
App-SG
) with adequate inbound rules for users to access the app (or perhaps from a Load Balancer -- I'll assume you have that configured correctly)
- A Security Group on the Amazon RDS database (
DB-SG
) with an inbound rule that permits access from App-SG
on the database port
That is, DB-SG
should specifically reference the App-SG
in its inbound rules. This will give permission for any of the EC2 instances to connect to the database.
Feel free to create new Security Groups with appropriate names and rules, then associate those Security Groups with the EC2 instances (via Elastic Beanstalk) and the database. You do not need to keep using the Default security group.