Skip to main content

VPC: security groups and endpoints

Default VPC security group changes

Modify the security group to allow TCP ports 3306 and 6379 (for MariaDB and Redis) to be accessed by each of your Lightsail servers.

Note: for live environments or any other environment using a load balancer, you will want to modify the security group rules to use the Lightsail servers' IPv6 addresses if your load balancer is the only server using an IPv4 address.

VPC Endpoints

Three endpoints are required, two gateway endpoints and one interface. All of these are necessary to allow Lambda functions that reside within your default VPC to be able to access the services listed below.

Gateway Endpoints (no costs)

  • S3 endpoint from the S3 service name (com.amazonaws.eu-west-3.s3) to your default VPC
  • DynamoDB endpoint from the DynamoDB service name (com.amazonaws.eu-west-3.dynamodb) to your default VPC

Interfaces (costs ~$8/month per endpoint per subnet)

  • SSM interface from the SSM service name (com.amazonaws.eu-west-3.ssm) to your default VPC, to allow Lambda functions to access the Systems Manager and therefore the Parameter Store to get credentials
Back to top