I'm using AWS SAM to provision API Gateway, Lambda functions, and an RDS database. I want to automate schema migrations with a tool like Alembic, but I don't want to maintain an EC2 instance solely to connect to the database and run migration commands. Since the RDS instance is in a private subnet, what's the cleanest way to run migrations during deployments while keeping the setup serverless?
3 Answers
You could also use a database proxy or another controlled access point, allow it to connect to RDS, and run the migration script from an external job. The important part is that the migration runner has a route into the private subnet and is allowed by the RDS security group. Alembic itself is still usable; it doesn’t require an EC2 instance, just a runtime with the right network access and database dependencies.
You can run the migration from your CI/CD pipeline instead of keeping an EC2 host around. The job needs network access to the private database, which you can provide by running the build inside the VPC or through an appropriate network path. Package Alembic and the database driver into the build environment, then execute the migration as a deployment step.
A migration Lambda is another option. Since SAM can place Lambda functions in the same VPC and subnets that can reach RDS, you can package Alembic and its driver into a Lambda layer or deployment artifact, then invoke that function once per release. It could also be triggered as part of the infrastructure deployment, although you should make sure it runs only once and handles retries safely.
That sounds promising. I was mainly assuming migrations needed a persistent server, but a VPC-connected deployment job or one-off Lambda should work as long as the security groups and dependencies are configured correctly.