Connecting to a Cloud Platform database

If you have an RDS instance on Cloud Platform and a namespace on a Container Platform cluster, you can use a port-forward pod on the Container Platform to reach that database and prove connectivity.

There are two parts to it:

Allow your cluster’s address range through the database’s security group. This is a Terraform change in your Cloud Platform namespace.
Connect to the database. You can connect your application, or use a port-forward pod to connect from your own machine.

Before you start

You need:

a namespace on a Container Platform nonlive cluster. See Deploying an application to the Container Platform
an RDS instance in a Cloud Platform namespace, created with the RDS module. See Cloud Platform namespace user guide and RDS user guide
the ability to raise a pull request against cloud-platform-environments

Step 1: Allow your cluster to reach the database

In your Cloud Platform namespace, add a security-group.tf file to the resources directory:

data "aws_vpc" "selected" {
  filter {
    name   = "tag:Name"
    values = [var.vpc_name == "live" ? "live-1" : var.vpc_name]
  }
}

resource "aws_security_group" "rds" {
  name        = "${var.namespace}-rds-sg"
  description = "Allow Container Platform access to this database"
  vpc_id      = data.aws_vpc.selected.id

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group_rule" "rds_inbound" {
  type              = "ingress"
  description       = "Container Platform nonlive"
  from_port         = 5432
  to_port           = 5432
  protocol          = "tcp"
  security_group_id = aws_security_group.rds.id
  cidr_blocks       = ["10.195.48.0/20"] # your cluster, see the table below
}

You must change cidr_blocks to your Container Platform cluster:

Cluster	Address range
`container-platform-octo-nonlive`	`10.195.48.0/20`
`container-platform-hmpps-nonlive`	`10.195.64.0/20`
`container-platform-laa-nonlive`	`10.195.80.0/20`
`container-platform-cd-nonlive`	`10.195.96.0/20`

These are the node ranges. Your pods have their own addresses, but traffic leaving the cluster appears to come from the node it is running on, so the node range is what the security group needs to allow.

More clusters will be added over time. The ranges for every cluster are defined in the vpc_cidr map in network/locals.tf, where primary is the node range you need and secondary is the pod range.

If your cluster is not listed above, use the primary value for it from that file. Ask in #container-platform-alpha-users if you are not sure which applies to you.

Then attach the security group to your RDS instance. In the file where you call the RDS module, add:

module "rds" {
  source = "github.com/ministryofjustice/cloud-platform-terraform-rds-instance?ref=<version>"

  vpc_name               = var.vpc_name
  vpc_security_group_ids = [aws_security_group.rds.id]

  # ...the rest of your configuration
}

Creating the security group is not enough on its own. If you do not add vpc_security_group_ids, the rule has no effect and your connection will time out.

Raise a pull request with both changes. Once it is merged, the pipeline applies it.

The example above uses 5432 for PostgreSQL. Use the port for your engine:

Engine	Port
PostgreSQL (RDS and Aurora)	`5432`
MySQL and MariaDB	`3306`
Microsoft SQL Server	`1433`
Redis (ElastiCache)	`6379`

If you use an engine that is not listed, ask in #container-platform-alpha-users before you start. Traffic between the platforms passes through an inspection firewall that allows these ports only, and anything else is dropped without an error.

Step 2: Get Your Target RDS Details

You will need the following details to connect:

hostname
dbname
username
password

Get the credentials and other details from the RDS secret in your Cloud Platform namespace:

kubectl -n [your cloud platform namespace] get secret [your rds secret] -o go-template='
rds_instance_address: {{index .data "rds_instance_address" | base64decode}}
dbname: {{index .data "database_name" | base64decode}}
username: {{index .data "database_username" | base64decode}}
password: {{index .data "database_password" | base64decode}}
'

Step 3: Connect

Follow the instructions below depending on how you wish to connect:

This page was last reviewed on 9 October 2026. It needs to be reviewed again on 9 April 2027 by the page owner #cloud-platform-notify .