3

I have two RDS instances, both hosted in the same VPC, and on the same subnet. Both have the same security group applied. Both are the same size, encryption disabled, basically exactly the same other than the instance name and table name.

However, I can only connect to one of them (an older one). The one I've created (and recreated) today gives me 116 "Connection timed out" -- I can't even telnet to the endpoint:port. Are there factors outside of the RDS dashboard that I should look into? I've even tried adding Allow ALL from ::/0 to the security group, with no luck.

  • NACL? Database permissions? You'd have to screenshot everything (EC2, RDS, VPC, subnets, security groups, NACLs, and your pings) for us to be able to give you a definitive answer. If you're in US-EAST-1 there could be problems left over from yesterdays outage. – Tim Mar 1 '17 at 21:46
1

The problem here ended up being the default RDS Subnet Group (different from the VPC Subnet you typically use, most likely) auto-added both private and public IP blocks.

For my first RDS, it just so happened to get assigned a publicly accessible IP block (still a 10.x, but access from the public) -- my second RDS instance got a private one (so my apps in EC2 could connect, but I couldn't from outside the VPC). We've created a new RDS Subnet containing only private-access IP blocks, and will use ssh tunneling to administer the instances as needed, since publicly accessible DBs tend to not go so well..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.