I have the following setup: an RDS instance running in a subnet group of 2 private subnets; an EC2 instance running in a public subnet. So I want to connect to my RDS instance through my EC2 instance.

I want also to be able to connect from shell. So I run the following command on my local computer:

ssh -L 3305:mydb.myrdsinstance.eu-west-1.rds.amazonaws.com:3306 ec2-user@myec2instance

Thus I logged in my ec2 instance and tried to access the database with:

mysql -h localhost -u mydbuser -p

Entered the correct master password and got:

ERROR 1045 (28000): Access denied for user 'mydbuser'@'localhost' (using password: YES)

I also tried tunneling from my ec2 instance (by running the SSH command from it), this also creates connection but I cannot access the database the same as above.

I tried running the ssh command with -N option, this gives a blinking cursor and nothing happens.

The firewall is disabled on my local computer, all traffic allowed both for EC2 and RDS instance.

I also tried to set up connection with Workbench and there is a weird thing going on. When I connect and enter the master password, I am getting "Can't connect to MySQL server on (111)". But if I check "Save password in keychain", next time it connects fine without any changes.

How do I fix this and connect to the RDS instance via SSH tunnel with shell?

  • You can set up RDS so you can connect directly, subject to security groups and such allowing access. If you didn't enable that option when you set up RDS you used to have to create a new instance, but maybe by now you can update an existing instance.
    – Tim
    Nov 13 '17 at 6:49
  • I would prefer to not be able to connect directly to RDS. I am interested in keeping it private and connecting through SSH tunneling. Nov 14 '17 at 4:01
  • That's a perfectly reasonable architectural decision. You can lock down the IPs that can connect, and even open up the security group manually for the odd occasion you want to use it and otherwise have it blocked. But SSH tunneling is probably slightly more secure.
    – Tim
    Nov 14 '17 at 7:07
  • Why not use OpenVPN, really easy to deploy in AWS with the Marketplace AMI?
    – strongjz
    Nov 14 '17 at 13:05
  • @Tim, thank you for this alternative. I am not being paranoid, just doing some job for a course. This does not answer my question but I will use it doing a real job. Nov 15 '17 at 10:55
ssh -L 3305:mydb.myrdsinstance.eu-west-1.rds.amazonaws.com:3306 ec2-user@myec2instance

You need to forward port 3306 not port 3305.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.