I have a typical web application with a web server (PHP) and a database. It is on a new AWS account, not the EC-Classic style. I want to be able to access the database server from my desktop using a GUI-based tool such as Sequel Pro. How do I configure that?

The web server is on a subnet that accepts traffic from any source on port 80 or 443. It also accepts ssh traffic (port 22) from selected IP's. By way of outbound rules, it allows all traffic to any destination, but has a specific rule to allow traffic on port 3306 (MySql) to go to the database security group.

There are 2 database subnets, since RDS insists on at least two availability zones. I am only using one though, as I have no need for replication. The inbound rules on the database security group allow traffic on port 3306 from either the web server security group, or my desktop IP.

When I try to access RDS from my desktop it says it cannot connect to the host, or it timed out. Upon investigation, I found that my RDS instance was set to 'not publicly available'. When I try to change that, it says my VPC does not support DNS resolution... When I read up on DNS resolution, it tells me I need to enableDnsHostnames, and enableDnsSupport, but does not say how. Other articles however suggest that there is more to it than that.

So, how should I be going about accessing this database with a GUI client? Should I:

  • Continue down the path of enabling DNS resolution on my VPC, and if so, how?, or
  • Should I be considering some other approach, such as accepting 3306 traffic on the web server subnet and forwarding it to RDS?


I came across the options to enable DNS resolution, and turned these on, and was able to connect immediately. I am happy with that. For anyone else reading this, you change your DNS resolution setup by selecting the VPC from the "Your VPC's", then choosing Actions (top of screen).

  • Please post and answer rather than editing the question. It makes it much more clear that the question is answered. – Tim Jun 17 '18 at 7:35
  • @Tim, although this go me working, I'm not sure the question is fully answered. I'm not 100% sure that I should be using this method. – Kim Jun 17 '18 at 8:27
  • I have a tutorial which provides some more information. In short you allow public access to RDS but ensure that the applicable security group limits access to only the IPs that need access. – Tim Jun 17 '18 at 9:14

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.