2

I am trying to deploy a django app on AWS with a setup where I have one EC2 instance that is running nginx/uwsgi and a second EC2 instance where I have MySQL 5.5 installed. Both belong to the default group ( enabled SSH, HTTP, HTTPS and MYSQL). Eventually, I will split the groups for DB and the app/web server but for now I want to get the app to work.

My django db settings look like:

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.mysql',
        'NAME': 'db',         
        'USER': 'db_user',      
        'PASSWORD': 'db_pwd',
        'HOST': '<public dns of MySQL EC2 instance(tried also private ip)>',
        'PORT': '3306', 
    }
}

Each time I try to run syncdb I get the following error:

_mysql_exceptions.OperationalError: (1130, "Host 'ip-xx-xx-xx-xxx.ec2.internal' is not allowed to connect to this MySQL server")

Please note when I setup MySQL in the same EC2 instance as the web/app server the app works. In that instance my settings file db settings looked like:

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.mysql',
        'NAME': 'db',         
        'USER': 'db_user',      
        'PASSWORD': 'db_pwd',
        'HOST': '',
        'PORT': '', 
    }
}

I commented out the bind 127.0.0.1 in /etc/mysql/my.cnf file as one post suggested and even set it at 0.0.0.0 (restarted MySQL after the changes) but that didn't help.

Any suggestions?

Thanks

Binary Maze

6
  • When setting up the security group, don't enable the MySQL port (3306) for the general Internet as this is dangerous. Instead, enable it only for a security group in your account so only your instances can connect to it. You would need to use the internal IP address, not the public IP address when connecting from a client. Aug 8, 2012 at 3:43
  • "bind-address = 0.0.0.0" lets MySQL accept connections from other hosts (subject to security group and iptables rules) so that's good. Aug 8, 2012 at 3:44
  • Any chance you're running iptables? Aug 8, 2012 at 3:46
  • I am not running iptables. I removed 3306 from the security group and added bind-address = 0.0.0.0 to my.conf (restarted mysql). Ran syncdb again and got the same error message. Aug 8, 2012 at 4:44
  • @EricHammond - I created a user 'user'@'<EC2 Private DNS of client machine>' and issued grants on the db and syncdb ran. The app is working. However, if I have multiple instances trying to communicate to this MySQL instance it would not be feasible as I would have to setup an account on MySQL for each instance. Is there a better way of doing this? Aug 8, 2012 at 5:44

1 Answer 1

2

[Putting together this answer from the comment stream.]

When setting up the security group, don't enable the MySQL port (3306) for the general Internet (0.0.0.0/0) as this is dangerous. Instead, enable port 3306 it only for a security group in your account so only your instances can connect to it.

You will need to use the internal IP address of the database server, not the public IP address when connecting from a client on another instance.

"bind-address = 0.0.0.0" lets MySQL accept connections from other hosts (subject to security group and iptables rules).

Granting permissions to 'someuser'@'%' allows that user to connect from any host, subject to the security group restrictions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .