Question: **I am setting up an infrastructure using Fargate and RDS for my web application.** 

Here are the basic details of infrastructure. 

1. Fargate and RDS are using same VPC and same Subnet
2. We have an Application Load Balancer infront of Fargate
3. Able to access container applications using LB url

Now the problem is, Fargate container application is not able to connect to RDS 

Can somebody suggest how to configure security groups or other perimeters to allow containers to connect RDS. 

> 
> If I change RDS SG configuration with RDS port and IP as 0.0.0.0/0
>  (Anywhere) container application is able to connect to RDS. But this
>  we will not be able to do in UAT / PROD
> 
> 
>

Answer: 
1. Find the security group ID of your Fargate service. It will look
like `sg-ab3123b1252`, but with different values after `sg-`.
2. In your RDS security group rules, instead of putting a CIDR in your source
field, put the Fargate service security group ID. Port 5432 (assuming you are using the standard postgresql port).

By adding the Fargate security group to your RDS security group rule, you're saying "allow TCP traffic on port 5432 from any resource that uses the Source security group specified". 

[Check the default VPC group in the docs](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html#DefaultSecurityGroup). That page is required reading anyway, but the section linked has an example of what I'm describing specifically.
In addition to allowing the Security Group access we also had to grant IAM permissions to the role used by our ECS stuff.