How to make a RDS instance via Inbound Rules/Securitygroups receive access from an EC2 instance?

Question

For my RDS instance to receive access only from my EC2 instance via Security Group, i create Mysql permission on Inbound Rules and use the Private IP of the EC2 instance or the CIDR of my Subnet?

Both works perfectly. Which one to use and why?

Answer 1

Use the Subnet CIDR because in case of substitution of the EC2 Instance as for example in a repair case from a Snapshot, you do not need to change the rule.