AWS, Cloud Computing

4 Mins Read

Enhancing Database Security with a Dynamic Approach to IP Whitelisting in Amazon RDS


In the ever-evolving landscape of data security, safeguarding Amazon RDS (Relational Database Service) is paramount. Traditional static IP whitelisting for database access presents challenges in dynamic cloud environments. This blog introduces a progressive solution utilizing AWS Lambda and Amazon API Gateway, offering a dynamic approach to IP whitelisting for heightened database security on Amazon RDS.


Ensuring the security of your Amazon RDS instance requires an adaptive strategy that can seamlessly respond to changes in network configurations. Static IP whitelisting, though effective, falls short in dynamic cloud environments where IP addresses are prone to frequent changes.

This blog explores an advanced solution, leveraging AWS Lambda functions and Amazon API Gateway, to create a dynamic IP whitelisting mechanism for Amazon RDS that adapts in real time to enhance both security and operational efficiency.

Empowering organizations to become ‘data driven’ enterprises with our Cloud experts.

  • Reduced infrastructure costs
  • Timely data-driven decisions
Get Started

Challenge of Static IP Whitelisting

Static IP whitelisting, involving the manual configuration of fixed IP addresses allowed to access an Amazon RDS instance, poses challenges in maintaining accuracy and responsiveness to changes. These limitations underscore the need for a more dynamic and automated approach to IP whitelisting.

Advantages of the Dynamic Approach

  • Real-time Adaptability: Responding to changes in the network instantly, the dynamic IP whitelisting solution reduces the risk of unauthorized access.
  • Automation: The automated nature of Lambda functions minimizes manual effort, enhancing operational efficiency and reducing the likelihood of errors.
  • Scalability: Tailored for dynamic cloud environments, this approach seamlessly accommodates new IP addresses as your infrastructure scales.
  • Enhanced Security: The combined strength of AWS Lambda and Amazon API Gateway provides a secure mechanism for managing IP whitelists, fortifying the overall security of Amazon RDS.


  • AWS Account with necessary permissions.
  • Amazon RDS instance (MySQL) is publicly accessible.

A guide to whitelist IP for enhanced database security

Step 1: Create a Security Group

  • Go to the Amazon VPC console and identify the VPC of your RDS instance.
  • Create a new security group for IP whitelisting inside the same VPC (e.g., test).
  • Configure inbound rules: Custom TCP, Port Range: 3306, Source: ip_address
  • Configure outbound rules: All TCP, Port Range: 0-65535, Destination: anywhere


  • Provide a “test” Security group as a source inside the Amazon RDS Security group.


Step 2: Set Up the AWS Lambda Function

  • In the AWS Management Console, use the search bar and enter “AWS Lambda”.
  • Click on the Create function. Choose an Author from scratch.
  • Enter a name for your Lambda function, such as “test”
  • Choose the Python 3.9 runtime from the “Runtime” dropdown.
  • In the Role section, choose Create a new role with basic Lambda permissions from the Role
  • Click on the Create function


Code snippet:

Step 3: Set up Amazon API Gateway

  • Navigate to the Amazon API Gateway console.
  • Click on Create API.
  • Choose REST API as the API Type. Next, click on Build.
  • In the API Details section, choose New API and provide the API Name. Once it is done, click on Create API.
  • In the newly created resource, click on the Create Method
  • In the Method details section, choose GET as the Method type, Lambda function as the Integration type, and AWS Lambda function, which is created in the previous step, as the AWS Lambda function. Next, click on the Create method.
  • Select the method created previously, go to the Integration request tab, and click on edit.
  • In the mapping template section, choose Content type as “application/json” and use the template body:


   “sourceIP” : “$context.identity.sourceIp”,

   “source” :”apigateway”


  • Click on Save.


  • Choose Deploy API. Select a new stage, provide a name, and click on Deploy.


Step 4:  Testing

  • Take the invoke URL created in the previous step and test it in the browser.


Note: You can schedule a CRON job to delete the rule at the end of the day.


Incorporating AWS Lambda and Amazon API Gateway into your Amazon RDS security strategy provides a dynamic and automated solution to IP whitelisting, ensuring real-time adaptability, enhanced automation, and scalability. This approach fortifies the overall security posture of your database, addressing the limitations of traditional static IP whitelisting in dynamic cloud environments.

Drop a query if you have any questions regarding AWS Lambda, Amazon API Gateway or Amazon RDS and we will get back to you quickly.

Pioneers in Cloud Consulting & Migration Services

  • Reduced infrastructural costs
  • Accelerated application deployment
Get Started

About CloudThat

CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more.

CloudThat is recognized as a top-tier partner with AWS and Microsoft, including the prestigious ‘Think Big’ partner award from AWS and the Microsoft Superstars FY 2023 award in Asia & India. Having trained 650k+ professionals in 500+ cloud certifications and completed 300+ consulting projects globally, CloudThat is an official AWS Advanced Consulting Partner, AWS Training Partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner, Microsoft Gold Partner, AWS Microsoft Workload Partners, Amazon EC2 Service Delivery Partner, and many more.

To get started, go through our Consultancy page and Managed Services PackageCloudThat’s offerings.


1. Why is dynamic IP whitelisting crucial for Amazon RDS security?

ANS: – Dynamic IP whitelisting ensures real-time adaptability to network changes, reducing the risk of unauthorized access.

2. How does automation through AWS Lambda functions improve operational efficiency?

ANS: – Automation with AWS Lambda minimizes manual effort, enhancing operational efficiency and reducing the likelihood of errors in the IP whitelisting process.

3. Can this dynamic approach accommodate new IP addresses as infrastructure scales?

ANS: – Yes, the dynamic approach seamlessly accommodates new IP addresses, making it highly scalable in dynamic cloud environments.


Anusha works as Research Associate at CloudThat. She is an enthusiastic person about learning new technologies and her interest is inclined towards AWS and DataScience.



    Click to Comment

Get The Most Out Of Us

Our support doesn't end here. We have monthly newsletters, study guides, practice questions, and more to assist you in upgrading your cloud career. Subscribe to get them all!