# RDS access, policy roles serverless.yml setup **URL:** \ **Category:** Serverless Framework\ **Tags:** aws\ **Created:** [May 30, 2017, 4:49am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960 "2017-05-30T04:49:27Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![elliotrock](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@elliotrock](https://forum.serverless.com/u/elliotrock)\ **Post date:** [May 30, 2017, 4:49am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/1 "2017-05-30T04:49:27Z")
Hi, I cannot get my Lambda functions to access my public RDS Postgresql database. I can connect locally and via tests. I was using a IAM User which had AdministratorAccess. I need a clean way to configure this moving forward. How would I set this up in my .yml file: ```auto iamRoleStatements: - Effect: "Allow" Action: - "ec2:CreateNetworkInterface" - "ec2:DescribeNetworkInterfaces" - "ec2:DeleteNetworkInterface" Resource: "*" - Effect: "Allow" Action: - "s3:ListBucket" Resource: Fn::Join: - "" - - "arn:aws:s3:::" - Ref: ServerlessDeploymentBucket - Effect: "Allow" Action: - "s3:PutObject" Resource: Fn::Join: - "" - - "arn:aws:s3:::" - Ref: ServerlessDeploymentBucket - "/*" ``` Does this look right? Are the EC2 actions correct? ---
**Author:** ![elliotrock](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@elliotrock](https://forum.serverless.com/u/elliotrock)\ **Post date:** [May 30, 2017, 5:00am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/2 "2017-05-30T05:00:32Z")
not working still, trying to burrow into the cloudwatch logs ---
**Author:** ![elliotrock](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@elliotrock](https://forum.serverless.com/u/elliotrock)\ **Post date:** [May 30, 2017, 5:08am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/3 "2017-05-30T05:08:10Z")
This is my current serverless.yml: ```auto provider: name: aws runtime: nodejs4.3 profile: serverless-bankstatement-test timeout: 30 iamRoleStatements: - Effect: "Allow" Action: - "rds:*" - "cloudwatch:DescribeAlarms" - "cloudwatch:GetMetricStatistics" - "ec2:CreateNetworkInterface" - "ec2:DescribeNetworkInterfaces" - "ec2:DeleteNetworkInterface" - "ec2:DescribeAccountAttributes" - "ec2:DescribeAvailabilityZones" - "ec2:DescribeSecurityGroups" - "ec2:DescribeSubnets" - "ec2:DescribeVpcs" - "sns:ListSubscriptions" - "sns:ListTopics" - "logs:DescribeLogStreams" - "logs:GetLogEvents" Resource: "*" - Effect: "Allow" Action: - "s3:ListBucket" Resource: Fn::Join: - "" - - "arn:aws:s3:::" - Ref: ServerlessDeploymentBucket - Effect: "Allow" Action: - "s3:PutObject" Resource: Fn::Join: - "" - - "arn:aws:s3:::" - Ref: ServerlessDeploymentBucket - "/*" ``` Not working, but I noticed my RDS is available in `ap-southeast-2b` whilst my lambda functions are deployed to US East (N. Virginia) . Could this be an issue? ---
**Author:** ![garethmcc](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/garethmcc/32/2276_2.png) [@garethmcc](https://forum.serverless.com/u/garethmcc)\ **Post date:** [May 30, 2017, 6:16am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/4 "2017-05-30T06:16:55Z")
Your RDS database and Lambda function are required to be within the same VPC. The instruction on the AWS side on how to do so is [here](http://docs.aws.amazon.com/lambda/latest/dg/vpc-rds.html) and how to specify VPC details in the Serverless framework is [here](https://serverless.com/framework/docs/providers/aws/guide/functions#vpc-configuration). Hope that helps ---
**Author:** ![elliotrock](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@elliotrock](https://forum.serverless.com/u/elliotrock)\ **Post date:** [May 30, 2017, 7:54am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/5 "2017-05-30T07:54:39Z")
The second url is the same mate. Thanks ---
**Author:** ![garethmcc](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/garethmcc/32/2276_2.png) [@garethmcc](https://forum.serverless.com/u/garethmcc)\ **Post date:** [May 30, 2017, 7:58am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/6 "2017-05-30T07:58:33Z")
Thanks. Fixed. Was in a hurry as I was busy heading out as I posted that. ---
**Author:** ![elliotrock](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@elliotrock](https://forum.serverless.com/u/elliotrock)\ **Post date:** [May 31, 2017, 12:50am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/7 "2017-05-31T00:50:55Z")
Thanks again. I created a new IAM Role, which before I was adding the policies to the existing IAM User which was created for the serverless deployment: This is the provider part of my serverless.yml: ```auto provider: name: aws runtime: nodejs4.3 profile: serverless-deploy role: arn:aws:iam::{account}:role/{role-name} timeout: 30 vpc: securityGroupIds: - {my SG id, same for the RDS VPC} subnetIds: - {VPC subnet 1, same for the RDS VPC} - {VPC subnet 2, same for the RDS VPC} iamRoleStatements: - Effect: "Allow" Action: - "ec2:CreateNetworkInterface" - "ec2:DescribeNetworkInterfaces" - "ec2:DeleteNetworkInterface" - "logs:CreateLogGroup" - "logs:CreateLogStream" - "logs:PutLogEvents" Resource: "*" - Effect: "Allow" Action: - "s3:ListBucket" Resource: Fn::Join: - "" - - "arn:aws:s3:::" - Ref: ServerlessDeploymentBucket - Effect: "Allow" Action: - "s3:PutObject" Resource: Fn::Join: - "" - - "arn:aws:s3:::" - Ref: ServerlessDeploymentBucket - "/*" ``` This doesn’t work. I am concerned that the `profile` and `role` have conflicts. **UPDATE:** This works it was the IP of the security group on AWS that needed to be set for internal access. ---
**Author:** ![elliotrock](https://avatars.discourse-cdn.com/v4/letter/e/8797f3/32.png) [@elliotrock](https://forum.serverless.com/u/elliotrock)\ **Post date:** [May 31, 2017, 1:51am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/8 "2017-05-31T01:51:53Z")
I also needed to set my Security Group Postgres TCP IP to accept calls from IP 0.0.0.0/0 which is all internal calls basically. Thanks for the help ---
**Author:** ![ObiWan](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@ObiWan](https://forum.serverless.com/u/ObiWan)\ **Post date:** [October 12, 2017, 7:56pm UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/9 "2017-10-12T19:56:10Z")
Hmm. If I create a database on aws. Should it then be possible for me to deploy a nodejs function (lambda) and with configuration in serverless.yml give it access to my database? If I deploy my function and then go to my database and allow everyone to connect to it then it works. But is that nesseserry? By reading here I have read I should configure this vpc: securityGroupIds: - sg-9999999 subnetIds: - subnet-9999999 - subnet-9999999 - subnet-9999999 The security group is from my mysql instance details page. And so are the subnets. Is that correct? It still doesnt work unless I allow access to my db from all ips. ---
**Author:** ![ObiWan](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@ObiWan](https://forum.serverless.com/u/ObiWan)\ **Post date:** [October 12, 2017, 8:14pm UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/10 "2017-10-12T20:14:12Z")
Ok. Just learned a little more. The vpc securityGroup I add for my functions serverless.yml is the group which will be added to that function. And then what I need to do before that is to allow that group access to that vpc I use. Is that the same way you guys do it? or is there a smarter way 🙂 ---
**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\ **Post date:** [October 12, 2017, 11:33pm UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/11 "2017-10-12T23:33:48Z")
RDS + Lambda is complicated. It feels like you need to chose between security or fast cold start times. If your Lambda is inside the VPC your database is secure but your Lamdba cold start time rises from 3s to 13s. Deploy Lambda outside the VPC and you need to open your database to the world. ---
**Author:** ![ObiWan](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@ObiWan](https://forum.serverless.com/u/ObiWan)\ **Post date:** [October 13, 2017, 5:32am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/12 "2017-10-13T05:32:53Z")
Thx for replying 😀. Can you tell me how I decide if my lambda runs on the vpc or “normal”. Is that by giving the lambdas security group access to the vpc resource? ---
**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\ **Post date:** [October 13, 2017, 6:23am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/13 "2017-10-13T06:23:46Z")
Ultimately I decided that Lambda + RDS was a bad idea for a web app and stayed with DynamoDB. If I had to connect to RDS from Lambda then I would run the Lambda inside the VPC for security reasons. ---
**Author:** ![ObiWan](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@ObiWan](https://forum.serverless.com/u/ObiWan)\ **Post date:** [October 13, 2017, 5:01pm UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/14 "2017-10-13T17:01:44Z")
Ill take a look at DynamoDB. Im starting up a new project and still havent chosen the technology stack. ---
**Author:** ![ObiWan](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@ObiWan](https://forum.serverless.com/u/ObiWan)\ **Post date:** [October 13, 2017, 7:19pm UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/15 "2017-10-13T19:19:35Z")
Do you code with nodejs? whcih library do you use? On this page there are so many to choose from [https://aws.amazon.com/dynamodb/community/](https://aws.amazon.com/dynamodb/community/) ---
**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\ **Post date:** [October 14, 2017, 12:32am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/16 "2017-10-14T00:32:13Z")
I’ve been using [http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/DynamoDB/DocumentClient.html](http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/DynamoDB/DocumentClient.html) ---
**Author:** ![ObiWan](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@ObiWan](https://forum.serverless.com/u/ObiWan)\ **Post date:** [October 15, 2017, 6:02pm UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/17 "2017-10-15T18:02:08Z")
Cool thx. The last days I have ben googling a bit about dynamodb it seems a few of the week points are transaction handling and backup of the database. Is that something you also experience as a problem? ---
**Author:** ![ObiWan](https://avatars.discourse-cdn.com/v4/letter/o/e47774/32.png) [@ObiWan](https://forum.serverless.com/u/ObiWan)\ **Post date:** [October 15, 2017, 8:57pm UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/18 "2017-10-15T20:57:44Z")
Ok looks like Im to eager to ask questions. Just found out there is a batch put and batch delete. So I guess that solves the transactional issue. ---
**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\ **Post date:** [October 16, 2017, 8:30am UTC](https://forum.serverless.com/t/rds-access-policy-roles-serverless-yml-setup/1960/19 "2017-10-16T08:30:50Z")
Backup is fine. There are no transactions. The eventual consistency can also be a problem if you don’t design your app to deal with it.