I am having trouble gaining access to a MySQL RDS instance.

I am trying to connect to the RDS instance from an EC2 instance. Both the RDS instance and the EC2 instance are contained within the same VPC, myVPC. I have confirmed this by checking that VPC listed under the RDS instance and the RC2 instance matches.

Most of the questions about this issue that I found revolved around security groups. Many users had this difficulty and their problem was resolved by ensuring that the VPC security group associated with the RDS instance was the same as for their EC2 instance. In my case, both instances are on the same VPC and using the same security group. Within this security group, I have a rule that allows all inbound traffic across the full range of IPs of my VPC (ex, 172.35.0.0/16). In an attempt to get this working at all, I've allowed ALL traffic accross all ports from all IP addresses for this security group. This still has not worked.

Some reading of the documentation suggests that one should ensure that your subnets are associated with the same routing table used by your VPC. I've done this by going to the route table associated all subnets within myVPC with this routing table.

I have also tried it with and without an elastic IP. I am able to connect to my EC2 instance with the elastic IP address.

I realize that this question is asked quite a lot. As of yet, I haven't come accross one whose solution has solved my problem.

Edited: Adds more details of security settings Both the ec2 instance and RDS use the same security group. Within that security group is a line that says something like

MYSQL TCP 3306 172.35.0.0/16 My CIDR range

I added

MYSQL TCP 3306 172.35.0.1/32 My ec2 instance private IP

None of the above worked.

What DID work was under my network ACL settings I changed a line from

1 MySQL(3306) TCP(6) 3306 172.35.0.1/32 ALLOW

to

1 ALL TRAFFIC ALL ALL 0.0.0.0/32 ALLOW

So my problem has been worked out, but now I have another question. How can I avoid having 3306 open to all inbound connections. I may post this as a new question and link here.

I had this issue myself a couple of weeks ago. In my case, I had forgotten to allow outbound traffic on port 3306 for my EC2 instance to the VPC CIDR. Try adding an outbound rule to your EC2 instance security group looking something like this:

Type    Protocol    Port Range    Destination
MYSQL   TCP         3306          172.35.0.0/16
  • This hasn't fixed it either. My outbound rules allow for all outoing traffic on all ports for all IP addresses. This was the default setting when I created the security group. I edited it as you suggested in the hopes that it would solve the problem, but unfortunately it did not. – PhiloEpisteme Dec 14 '14 at 17:58
  • Interestingly, after edditing my ACL settings to allow all inbound traffic on all ports I was able to connect. If I remove this rule and change it to allow mysql traffic from my VPC CIDR, it will not work. I do not entirely understand why this is the case. If possible, I'd like to not allow all inbound traffic on all ports from the ACL. Is there a way to avoid this and be more specific with permissions? – PhiloEpisteme Dec 14 '14 at 18:47
  • Hmm. Could you update your post with a copy of your security groups attached to the RDS instance and EC2 instance respectively? And also their internal IPs? @vckngs7 – Bazze Dec 14 '14 at 21:51
  • You should not need to explicitly open outbound ports. Make sure that the RDS is accepting 3306 inbound and that you are using the VPC IP, not the external DNS name to access it. – TheFiddlerWins Dec 15 '14 at 15:18
  • @TheFiddlerWins, just to be clear, it's not needed if you already have a rule that allows outbound traffic on all ports. However, if you for example build your instance through CloudFormation and start specifying the SecurityGroupEgress property on your SecurityGroup with your own outbound rules you will loose the default outbound rule that allows all outbound traffic on all ports. In that case you will need to explicitly declare the outbound rule. – Bazze Dec 15 '14 at 15:47

Are you certain your DB is inside the VPC with your EC2 instance? Assuming so create a Security Group that permits 3306 inbound from the CIDR range for your VPC.

To test in a slightly more familiar way you can temp build an instance with MySQL on it, should work the same way as long as it is also in your VPC.

Make certain your RDS is in a Subnet Group that's accessible from other machines in your VPC, for instance make sure your able to route between subnets if you are multi-AZ etc.

Update: Also try using the VPC IP, not the external DNS name to access it, your DNS may point to an external network address or otherwise be failing.

  • Regarding your first comment, I'm fairly certain that both my EC2 instance and RDs instance are in the same VPC. If I look under the details of both instances, the VPC ID field is identical for both instances. The 3306 port is open as well. I have it open to the public IP address from the Elastic IP as well as the private IP and CIDR range. I am not using a multi-AZ setup. – PhiloEpisteme Dec 14 '14 at 7:35
  • Install mysql client on your instance and see if you can connect to the RDS manually. It is a little confusing - main thing is to make sure you have 3306 open! – TheFiddlerWins Dec 15 '14 at 15:17

After much hunting for a solution to the same problem I wanted to provide what appeared to work for. Originally I had RDS and the EC2 instance with difference security groups.

After updating RDS to use the VPC security group I was still unable to connect. What finally worked is when I added the inbound rule for port 3306 for the CDIR range on my VPC as answered by @TheFiddlerWins.

The VPC security group should encapsulate that rule already so disappointing that I can't say exactly why that caused it to work but it did work after that.

I had the same problem. I was using the micro instances with the free tier for testing. If your RDS and EC2 are not in the same availability zones then you will need to use the public IP. If they are in the same zone or the EC2 is shared between many zones then you can use the private IP.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.