Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to deploy a django app on AWS with a setup where I have one EC2 instance that is running nginx/uwsgi and a second EC2 instance where I have MySQL 5.5 installed. Both belong to the default group ( enabled SSH, HTTP, HTTPS and MYSQL). Eventually, I will split the groups for DB and the app/web server but for now I want to get the app to work.

My django db settings look like:

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.mysql',
        'NAME': 'db',         
        'USER': 'db_user',      
        'PASSWORD': 'db_pwd',
        'HOST': '<public dns of MySQL EC2 instance(tried also private ip)>',
        'PORT': '3306', 
    }
}

Each time I try to run syncdb I get the following error:

_mysql_exceptions.OperationalError: (1130, "Host 'ip-xx-xx-xx-xxx.ec2.internal' is not allowed to connect to this MySQL server")

Please note when I setup MySQL in the same EC2 instance as the web/app server the app works. In that instance my settings file db settings looked like:

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.mysql',
        'NAME': 'db',         
        'USER': 'db_user',      
        'PASSWORD': 'db_pwd',
        'HOST': '',
        'PORT': '', 
    }
}

I commented out the bind 127.0.0.1 in /etc/mysql/my.cnf file as one post suggested and even set it at 0.0.0.0 (restarted MySQL after the changes) but that didn't help.

Any suggestions?

Thanks

Binary Maze

share|improve this question
    
When setting up the security group, don't enable the MySQL port (3306) for the general Internet as this is dangerous. Instead, enable it only for a security group in your account so only your instances can connect to it. You would need to use the internal IP address, not the public IP address when connecting from a client. –  Eric Hammond Aug 8 '12 at 3:43
    
"bind-address = 0.0.0.0" lets MySQL accept connections from other hosts (subject to security group and iptables rules) so that's good. –  Eric Hammond Aug 8 '12 at 3:44
    
Any chance you're running iptables? –  Eric Hammond Aug 8 '12 at 3:46
    
I am not running iptables. I removed 3306 from the security group and added bind-address = 0.0.0.0 to my.conf (restarted mysql). Ran syncdb again and got the same error message. –  Binary Maze Aug 8 '12 at 4:44
    
@EricHammond - I created a user 'user'@'<EC2 Private DNS of client machine>' and issued grants on the db and syncdb ran. The app is working. However, if I have multiple instances trying to communicate to this MySQL instance it would not be feasible as I would have to setup an account on MySQL for each instance. Is there a better way of doing this? –  Binary Maze Aug 8 '12 at 5:44

1 Answer 1

[Putting together this answer from the comment stream.]

When setting up the security group, don't enable the MySQL port (3306) for the general Internet (0.0.0.0/0) as this is dangerous. Instead, enable port 3306 it only for a security group in your account so only your instances can connect to it.

You will need to use the internal IP address of the database server, not the public IP address when connecting from a client on another instance.

"bind-address = 0.0.0.0" lets MySQL accept connections from other hosts (subject to security group and iptables rules).

Granting permissions to 'someuser'@'%' allows that user to connect from any host, subject to the security group restrictions.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.