52

I created a basic test PostgreSQL RDS instance in a VPC that has a single public subnet and that should be available to connect over the public Internet. It uses the default security group, which is open for port 5432. When I try to connect, it fails. I must be missing something very straightforward—but I'm pretty lost on this.

Here’re the database settings. Note that it's marked as Publicly Accessible:

RDS Settings

Here’re the security group settings. Note it's wide open (affirmed in the RDS settings above by the green "authorized" hint next to the endpoint):

Security Group settings

Here's the command I'm trying to use to connect:

psql --host=myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com \
     --port=5432
     --username=masteruser
     --password
     --dbname=testdb

And this is the result I'm getting when trying to connect from a Mac OS X v10.10 (Yosemite) MacBook Pro (note, it's resolving to a 54.* IP address):

psql: could not connect to server: Operation timed out
    Is the server running on host "myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com" (54.xxx.xxx.xxx) and accepting
    TCP/IP connections on port 5432?

I do not have any kind of firewall enabled, and am able to connect to public PostgreSQL instances on other providers (e.g., Heroku).

How can I troubleshoot this?

Here are the inbound ACL rules for the default VPC:

Network ACL configuration

2
  • 1
    Did you happen to mess with the NetworkACLs? I would look there for a possible setting that could be blocking internet access.
    – Optichip
    Jan 3, 2015 at 16:57
  • Thanks for the reply! The ACLs appear to not be blocking anything, since the first rule is to allow all ports from all sources, per attached. Jan 3, 2015 at 21:16

5 Answers 5

64

The issue was that the inbound rule in the Security Group specified a security group as the source. Changing it to a CIDR that included my IP address fixed the issue.

Open the database security group in AWS; and choose "Edit inbound rules"; "Add rule". There is a "My IP" option in the dropdown menu; select that option to auto-populate with your computer's public IP address in CIDR notation:

Edit security group, edit its inbound rules, add a rule, choose "My IP" option in the "Source" column

4
  • 11
    For anyone who doesn't know how CIDR works; if your IP address is 91.61.76.202 (can find yours using myipaddress.com), set your source as 91.61.76.202/32
    – Tom G
    May 2, 2016 at 14:18
  • 1
    Would you be willing to take a screenshot of what this solution looks like?
    – smaccoun
    Jun 2, 2017 at 17:41
  • 1
    I would be happy to, but I no longer have this instance online. Jun 5, 2017 at 1:52
  • Still valid answer in 2024 Jan 27 at 19:48
18

I was facing similar issue, and this is how I resolved it:

Click on the security group for the RDS instance and check the inbound rules. You might see something like this:

Enter image description here

You have to set the IP address range to contain your IP address or just select "Anywhere" in the Source dropdown, to make it accessible from localhost or anywhere:

Enter image description here

1
  • 1
    Yes this works. I kept the Custom rule that was there and added a new rule which picked up my IP address automatically.
    – MSC
    Aug 17, 2018 at 3:29
8

I had a similar issue while connecting to PostgreSQL. Even though i had publically access true, i was not able to connect.

I added one rule inbound rule in the security group and now it is working perfectly fine.

Enter image description here

1

When creating a database (or restoring it from a snapshot), it is important to specify the database parameter "Public access" = "Yes"

1

I just wanted to add my findings to save someone some time.

This solution described above worked on a development EC2 instance, but after I migrated to a new server, it stopped working. It turned out both of my RDS instances and EC2 instances were in the same VPC, so the RDS instance could not see the public IP address that I had added to its security group.

To get this working, you need to add to the RDS instances security group, the private IP address of the EC2 instance that you can find in details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .