In AWS, our auto scaling group is launching new instances in different availability zones (for high availability) and these web instances of course require access to database (RDS) service on port 3306.

Now, what IP addresses should I allow in my RDS security group for port 3306?

Since each newly launched instance has different IP address each time so how can we add them into security group?

BTW: This is not just the issue for RDS security grouo but for all security groups as I can't restrict them.

2 Answers 2


You don't add IP addresses for EC2 instances to your RDS security group, you add another security group. This gives every instance in the security group your EC2 instance are in access to your RDS security group / resources.

In this slightly obfuscated image you can see that my web security group (ending f4) is added to my RDS security group (ending C6).

RDS access for EC2 instances

A related concept you may be aware of is IAM Roles. They're not applicable in this situation, but they're useful to know. They can allow EC2 instance access to practically any EC2 resource (eg S3) without having to store credentials. EC2 instances need to be started with the role, but I believe the role policy can be changed on the fly.

  • thansks it did work for RDS, Redis when I allowed the security group for auto-scaling web server, but there is an issue with NFS security group(I have a seperate instance which uses to share same files between auto-scaling instances) where I still need to allow every one all access otherwise it does not connect... weird!
    – Farmi
    Dec 18, 2016 at 22:26
  • You can start another question for your other issue. Consider AWS EFS instead of NFS.
    – Tim
    Dec 19, 2016 at 0:24
  • EFS performance is disaster i comparison to NFs separate instance, anyways, I have opened a case here: serverfault.com/questions/821500/…
    – Farmi
    Dec 19, 2016 at 0:37
  • Looks like you're correct about EFS being unusably slow for scenarios that use a lot of small files. There's quite a bit of latency, so large files are fine, but small not so much. FS-CACHE / cachefilesd is meant to help (based purely on what I've read).
    – Tim
    Dec 19, 2016 at 0:47

Your newly launched instances will be connected to their own security group. maybe they are part of a auto-scale group but it really doesn't matter. you can use the security group that the instances are using to give access to you RDS instance: enter image description here

Notice here we have the RDS security group that has an entry that allows traffic on TCP port 3306 from a custom source, the custom source is the security Group ID of the security group that your instance are connected to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .