Using Tailscale in subnet router mode to access RDS in a VPC.

Current version of this project uses the subnet router for NAT resolution as well, making it a two-purpose single box. Alternatively, this is an example with separate boxes, which can be adapted with existing code.

Create the .auto.tfvars from the template and set your variables accordingly.:

cp config/template.tfvars .auto.tfvars

Create the infrastructure:

terraform init
terraform apply -auto-approve

Connect to the Tailscale box using SSM:

aws ssm start-session --target <instance>

You can run some manual checks to verify if everything was installed correctly:

# Verify the cloud-init start up
cloud-init status
cat /var/log/cloud-init-output.log

# Check the state of the CloudWatch agent
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -m ec2 -a status

# Look if there are any Tailscale erros in crontab
grep CRON /var/log/syslog

Start Tailscale and advertise the subnet routes:

tailscale up --advertise-routes=10.0.0.0/16 --accept-dns=false

Use the link to accept link to register the device to Tailscale.

Now, add the VPC DNS to the Tailscale namespaces and approve the routes. You can disable key expiry as well.

Check the results status of Tailscale:

tailscale ip -4

Change the create_appserver parameter to true and create the private server to test NAT functionality.

You can install and run a speed test tool to also verify performance:

sudo apt install speedtest-cli
speedtest-cli --secure

A workflow is available based on the documentation.

To use it, create an OAuth client in Tailscale and set the variables.

Example of a policy to restrict access to personal devices, servers, and environments. More sample here.

{
  "tagOwners": {
    "tag:personal": ["[email protected]"],
    "tag:server":   ["[email protected]"],
    "tag:stage":    ["[email protected]"],
    "tag:prod":     ["[email protected]"],
  },

  "acls": [
    {
      "action": "accept",
      "src":    ["autogroup:member"],
      "dst":    ["autogroup:self:*"],
    },
    {"action": "accept", "src": ["autogroup:member"], "dst": ["tag:server:*"]},
    {"action": "accept", "src": ["tag:personal"], "dst": ["tag:server:*"]},
    {"action": "accept", "src": ["tag:stage"], "dst": ["tag:stage:*"]},
    {"action": "accept", "src": ["tag:prod"], "dst": ["tag:prod:*"]},
    {"action": "accept", "src": ["tag:prod"], "dst": ["tag:prod:*"]},
    {"action": "accept", "src": ["autogroup:owner"], "dst": ["*:*"]},
    {
      "action": "accept",
      "src":    ["[email protected]"],
      "dst":    ["tag:server:*"],
    },
  ],
}

https://tailscale.com/kb/1141/aws-rds
https://tailscale.com/kb/1174/install-debian-bookworm
https://tailscale.com/kb/1019/subnets?tab=linux
https://tailscale.com/kb/1021/install-aws#step-8-close-off-your-firewall
https://tailscale.com/kb/1235/resolv-conf?q=dns
https://repost.aws/questions/QUlEvYKkbUSNmZCiNJFcMpCA/aws-ec2-ubuntu-22-04-dns-issues-with-tailscale
https://tailscale.com/blog/how-tailscale-works
https://www.devzero.io/docs/how-can-i-connect-to-an-aws-rds-database