0

I am having trouble connecting to my RDS instance from my EC2 instance. I added the elastic IP address for the EC2 instance to the RDS security group. as follows: xx.xxx.xx/32

I am using a PHP script to test the connection.

I added my local IP address to the RDS security group as follows: xx.xxx.xx/32, and using the same script (running locally on my MAC),I can connect to it from my local PC ().

Here's the script I'm using to test:

<?php
$db_host = 'xxxxxxxxxx'; //this is the RDS endpoint, not the IP address
$db_user = 'xxxxxx';
$db_password = 'xxxxxx';
$db_name = 'xxxxxxx';

$mysqli = new mysqli($db_host, $db_user, $db_password, $db_name);
echo 'Server Info = '.$mysqli->server_info.'<br />';
echo 'Server Version = '.$mysqli->server_version.'<br />';
echo 'Connect Error = '.$mysqli->connect_error.'<br />';
?>

When I run it from my EC2 instance, I get the following:

Server Info =
Server Version =
Connect Error = Unknown MySQL server host 'xxxxxxxx' (20)

When I run it from my local machine (Mac), I get the following:

 Server Info = 5.5.27-log
 Server Version = 50527
 Connect Error = 

Any ideas?

  • 1
    Make sure you're using the RDS endpoint (something like .rds.amazonaws.com) and not the IP address. – Nathan C May 31 '13 at 12:35
  • If you mean in the php script, then yes, I am using the RDS end point. I just did not want to post the actual endpoint here – EastsideDeveloper May 31 '13 at 12:36
2

I am having trouble connecting to my RDS instance from my EC2 instance. I added the elastic IP address for the EC2 instance to the RDS security group. as follows: xx.xxx.xx/32

Chances are your EC2 instance is using its internal IP rather than the (external) Elastic IP. Remember, you can authorize a security group instead of an IP address - that's likely a better solution here.

  • I have the elastic IP address attached to the EC2 instance and it's verified when I click on the Instance and I see it both in the header and the description of the instance. As to the security group, I already have the EC2 instance security group added to the RDS security group. – EastsideDeveloper May 31 '13 at 13:01
  • 1
    As @ceejayoz mentioned, your instance will not connect to the DB server with your elastic IP, it will connect over the local 10.0.0.0 network so your RDS instance sees an incoming connection from that address, not your external EIP. If you give permission to "instances in your security group" rather than a particular IP you will be able to connect. – ianjs Jun 3 '13 at 10:48
0

When you use the "Endpoint" DNS name. It will resolve to the internal IP when used within EC2 and resolves to a public ip when used outside. You should never use the actual IP address in the security groups or the host configuration.

Your EC2 instance is trying to connect from the internal IP therefore your security Inbound/Outbound rules block it.

You should change your Security groups to accept traffic from each others security groups. This is a feature of the AWS security groups, just type in sg-* instead of the CIDR and it will show you all the options.

For example:

Type            Protocol      Port Range      Source      
All traffic      All            All            sg-**** (default)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.