Allow access to RDS instance from EC2 instance on same VPC

Question

I am having trouble gaining access to a MySQL RDS instance.

I am trying to connect to the RDS instance from an EC2 instance. Both the RDS instance and the EC2 instance are contained within the same VPC, myVPC. I have confirmed this by checking that VPC listed under the RDS instance and the RC2 instance matches.

Most of the questions about this issue that I found revolved around security groups. Many users had this difficulty and their problem was resolved by ensuring that the VPC security group associated with the RDS instance was the same as for their EC2 instance. In my case, both instances are on the same VPC and using the same security group. Within this security group, I have a rule that allows all inbound traffic across the full range of IPs of my VPC (ex, 172.35.0.0/16). In an attempt to get this working at all, I've allowed ALL traffic accross all ports from all IP addresses for this security group. This still has not worked.

Some reading of the documentation suggests that one should ensure that your subnets are associated with the same routing table used by your VPC. I've done this by going to the route table associated all subnets within myVPC with this routing table.

I have also tried it with and without an elastic IP. I am able to connect to my EC2 instance with the elastic IP address.

I realize that this question is asked quite a lot. As of yet, I haven't come accross one whose solution has solved my problem.

Edited: Adds more details of security settings Both the ec2 instance and RDS use the same security group. Within that security group is a line that says something like

MYSQL TCP 3306 172.35.0.0/16 My CIDR range

I added

MYSQL TCP 3306 172.35.0.1/32 My ec2 instance private IP

None of the above worked.

What DID work was under my network ACL settings I changed a line from

1 MySQL(3306) TCP(6) 3306 172.35.0.1/32 ALLOW

to

1 ALL TRAFFIC ALL ALL 0.0.0.0/32 ALLOW

So my problem has been worked out, but now I have another question. How can I avoid having 3306 open to all inbound connections. I may post this as a new question and link here.

Answer 1

I had this issue myself a couple of weeks ago. In my case, I had forgotten to allow outbound traffic on port 3306 for my EC2 instance to the VPC CIDR. Try adding an outbound rule to your EC2 instance security group looking something like this:

Type    Protocol    Port Range    Destination
MYSQL   TCP         3306          172.35.0.0/16

Answer 2

Are you certain your DB is inside the VPC with your EC2 instance? Assuming so create a Security Group that permits 3306 inbound from the CIDR range for your VPC.

To test in a slightly more familiar way you can temp build an instance with MySQL on it, should work the same way as long as it is also in your VPC.

Make certain your RDS is in a Subnet Group that's accessible from other machines in your VPC, for instance make sure your able to route between subnets if you are multi-AZ etc.

Update: Also try using the VPC IP, not the external DNS name to access it, your DNS may point to an external network address or otherwise be failing.

Answer 3

I had the same problem. I was using the micro instances with the free tier for testing. If your RDS and EC2 are not in the same availability zones then you will need to use the public IP. If they are in the same zone or the EC2 is shared between many zones then you can use the private IP.

Answer 4

After much hunting for a solution to the same problem I wanted to provide what appeared to work for. Originally I had RDS and the EC2 instance with difference security groups.

After updating RDS to use the VPC security group I was still unable to connect. What finally worked is when I added the inbound rule for port 3306 for the CDIR range on my VPC as answered by @TheFiddlerWins.

The VPC security group should encapsulate that rule already so disappointing that I can't say exactly why that caused it to work but it did work after that.