1

I am having trouble connecting to my RDS instance from my EC2 instance. I added the elastic IP address for the EC2 instance to the RDS security group. as follows: xx.xxx.xx/32

I am using a PHP script to test the connection.

I added my local IP address to the RDS security group as follows: xx.xxx.xx/32, and using the same script (running locally on my MAC),I can connect to it from my local PC ().

Here's the script I'm using to test:

<?php
$db_host = 'xxxxxxxxxx'; //this is the RDS endpoint, not the IP address
$db_user = 'xxxxxx';
$db_password = 'xxxxxx';
$db_name = 'xxxxxxx';

$mysqli = new mysqli($db_host, $db_user, $db_password, $db_name);
echo 'Server Info = '.$mysqli->server_info.'<br />';
echo 'Server Version = '.$mysqli->server_version.'<br />';
echo 'Connect Error = '.$mysqli->connect_error.'<br />';
?>

When I run it from my EC2 instance, I get the following:

Server Info =
Server Version =
Connect Error = Unknown MySQL server host 'xxxxxxxx' (20)

When I run it from my local machine (Mac), I get the following:

 Server Info = 5.5.27-log
 Server Version = 50527
 Connect Error = 

Any ideas?

2
  • 1
    Make sure you're using the RDS endpoint (something like .rds.amazonaws.com) and not the IP address.
    – Nathan C
    May 31, 2013 at 12:35
  • If you mean in the php script, then yes, I am using the RDS end point. I just did not want to post the actual endpoint here May 31, 2013 at 12:36

2 Answers 2

3

I am having trouble connecting to my RDS instance from my EC2 instance. I added the elastic IP address for the EC2 instance to the RDS security group. as follows: xx.xxx.xx/32

Chances are your EC2 instance is using its internal IP rather than the (external) Elastic IP. Remember, you can authorize a security group instead of an IP address - that's likely a better solution here.

3
  • I have the elastic IP address attached to the EC2 instance and it's verified when I click on the Instance and I see it both in the header and the description of the instance. As to the security group, I already have the EC2 instance security group added to the RDS security group. May 31, 2013 at 13:01
  • 1
    As @ceejayoz mentioned, your instance will not connect to the DB server with your elastic IP, it will connect over the local 10.0.0.0 network so your RDS instance sees an incoming connection from that address, not your external EIP. If you give permission to "instances in your security group" rather than a particular IP you will be able to connect.
    – ianjs
    Jun 3, 2013 at 10:48
  • I recently had a similar issue with a "public" MSSQL Express instance on RDS (10 years after your reply). I could connect from any external host (for example, SSMS on my workstation, or sqlcmd from WSL/Ubuntu). But I COULDN'T connect from EC2. Using any of RDS endpoint name, external IP or internal IP address. Until I added an Inbound Rule to my RDS Security Group: type=MSSQL, source=EC2 Security Group ID. Your suggestion to add the rule for the RDS instance ... and to use a Security Group (vs. IP) was spot-on. Thank you.
    – paulsm4
    Aug 26, 2023 at 22:44
1

When you use the "Endpoint" DNS name. It will resolve to the internal IP when used within EC2 and resolves to a public ip when used outside. You should never use the actual IP address in the security groups or the host configuration.

Your EC2 instance is trying to connect from the internal IP therefore your security Inbound/Outbound rules block it.

You should change your Security groups to accept traffic from each others security groups. This is a feature of the AWS security groups, just type in sg-* instead of the CIDR and it will show you all the options.

For example:

Type            Protocol      Port Range      Source      
All traffic      All            All            sg-**** (default)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .