I have an RDS with multiple read replicas. In order to load balance the available read replicas, I used Route53's weighted hosted zone. I use this link for doing that: AWS Read Replica
After completing the steps provided in this link, I could connect to the RDS locally (after whitelisting my local IP). But when I try to connect to it from an EC2 server, it is giving the error:
ERROR 2005 (HY000): Unknown MySQL server host 'rds-endpoint.com' (0)
I have tried whitelist both the EC2 machine's public and private IPs. Not sure, what is causing the issue.
But, when I tried opening the MySQL port to the public (0.0.0.0/0,::/0), I can connect to it. What is the issue? How can I resolve it.
The server that I used was hosted in the default VPC and the RDS is hosted in another custom VPC. When I created an EC2 instance in the same VPC where the RDS is hosted, the issue resolved. I am able to call both public and private domain name of Route53's hosted zones.
With this, my issue got resolved. Not sure, whether there is any way to connect from other VPC.
Related
I have an application running on EC2 instances that store data in an RDS instance. All of these instances are in an AWS VPC with security groups configured to allow them to connect to each other.
For reporting purposes, I would like to connect to the RDS instance from my laptop (e.g. using SQLAlchemy) to run simple queries. Every time I try to connect using the connection string that the EC2 apps use, the connection times out.
For Google, one can use the Cloud SQL proxy for this, but I can't find an analogous product for AWS. Instead, it seems like what I am supposed to do is attach an internet gateway to the VPC and configure the security groups to allow connection from my machine. However, the documents are unclear on how to do this other than allowing all inbound connections or allowing a static IP. Unfortunately my laptop doesn't have a static IP, and I'm uncomfortable allowing all inbound connections as it seems insecure and an invitation to attacks. I also have not been able to find a way to configure a security group to allow connections based on IAM credentials for example using the AWS CLI. Since I will be routinely generating reports, a solution that involves updating a security group (i.e. allowing my current IP) every time I want to connect seems suboptimal.
I have tried following the following documents, but so far have had no success in finding a solution that does not allow all connections:
Allow users to connect to RDS using IAM*
Connecting to RDS instance from command line
Connecting to RDS on VPC from internet
*My RDS instance configuration does not allow me to enable IAM authentication, I'm not sure why
IAM Database Authentication is not supported for the configuration in the DB Instance db.
Modify your Db Instance to another instance class and try again.
(Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterCombination;
Request ID: a6194fb8-2ab9-4a6a-a2be-63835e6e0184)
Is there something I'm not understanding or overlooking? Is allowing connections from all IPs not a big deal since the DB instance is still secured by DB user credentials?
Select this connection as per screenshot. Then fill up all details use your nat instance .pem file to connect. Its like you are connecting to VPC through Nat gateway or Internet gateway bypassing this.
Another option to install VPN on VPC and connect.
I am trying to locally run a PHP based project, connecting to an Amazon RDS instance. I am receiving the following error in the browser:
![SQLSTATE[HY000] [2002]]1
I have run a series of networking tests where I pinged the following and received successful test results. I pinged:
iiNet's web address
One of iiNet's DNS servers
The loopback address of my computer
I pinged Google
I then tried the mysql utility to remotely connect and received the
ERROR 2003 (HY000): Can't connect to MySQL server
Last factor I think you should know regarding my own networking situation, I am connecting to the internet via:
modem->Zyxel VPN->Wireless Router->My laptop
What in the Sam Hill is going on?
Thanks,
CM
For this to work, the following must be true:
the RDS instance must resolve to a public IP address (I'd check this for you but since you chose to use a screenshot instead of text, I can't copy paste it, so I'll leave it to you)
the Security Group(s) associated with the RDS instance must allow traffic from your public IP ( the one you'll get from http://wtfismyip.com/text ). This won't bet true by default. I highly recommend you open to your IP, not just everyone, as Mysql is trivial to DOS attack if its port is public.
The network ACL of the VPC hosting the RDS instance must allow the traffic also. This will be allowed by default, so unless you changed the ACLs in your VPC, you can ignore this.
If all those are true, you should be able to connect!
I have an ElasticBeanstalk application that uses Docker to run a small Laravel PHP API.
The app cannot connect to MySQL when running in ElasticBeanstalk.
The MySQL DB is a publically available AWS RDS instance.
I've run my Docker container locally and the app can connect just fine.
When I deploy to ElasticBeanstalk the app cannot connect...
Can anyone point me in a direction to help debug this?
SOLUTION
For anyone else who stumbles on this:
The solution was to create a new security group for both the EC2 instances and the RDS database. The two security groups opened up access via port 3306 for the instances and the database.
I also ensured the EC2 instances were available across every subnet and in the same VPC as my database.
Taken from the answers below and bit of help from a SysOps friend of mine.
You may want to check the EC2 Security Group Rules attached to Elastic Beanstalk to allow TCP at port 3306 for MYSQL type.
High chance that your ec2 instance does not have a public ip assigned to it. If you're trying to connect to the public IP of RDS without a public ip on the ec2 instance you won't be able to.
The ec2 instance will either need a public ip or it will need to have external internet connectivity through NAT.
I have a MySQL database on Amazon RDS. When I created this database I unselected the "public access" option which can not be changed after creating the database. This means that my database instance can only be accessed from inside the VPC.
So now I would like to access the database in my local computer with setting the MySQL host with a EC2 VPS I have inside the network with access to the database. I want this server to act as my MySQL server so I can access it locally.
I just had to do this same thing. The process is to set up an SSH tunnel through the EC2 instance to the database. I wrote a post about the whole process that should be helpful
There's a couple of options -
Take a snapshot of the database and spin up a new copy that does allow public access. You can then use the security groups to only allow access from your ip - that way you have the benefit of the non public access security plus the ease of access from your machine.
If you don't want to do that, as datasage mentions your other option is to use an ssh tunnel - this will mean creating an ec2 instance in the same vpc that CAN access the rds, then using putty or your favourite ssh client to tunnel traffic through the 'bastion' ec2 instance to your database. This has the added layer of security but it's also more work to manage, depending on your familiarity with ssh. Not to mention the added cost of the ec2 instance.
I have an app with two workers (Web and Background) on AppHarbor that connect to a MySql database hosted on Amazon's RDS.
I keep getting "Unable to connect to any of the specified MySQL hosts." exception.
The RDS instance in the US-East region and I have added the following AppHarbor CIDR to the security group.
50.17.211.192/28
54.235.159.192/27
I have added my own CIDR to the security group and I connect to the instance just fine.
However when the app is running on AppHarbor it fails.
My connection string (censored) is:
Server=myinstanceXXXX.cykjvptrw5xs.us-east-1.rds.amazonaws.com;Database=MyDatabase;UID=XXXXXX;PWD=XXXXX;
I have tried including the port 3306 on the server endpoint but it made no difference.
Am I missing something on getting the two to play nice with one another?
By default AppHarbor use Amazon's internal DNS service for resolving hostnames. Because of that Amazon RDS instances in the same region as AppHarbor will resolve the private IP addresses rather than the public ones listed in the knowledge base article, so setting up rules based on the public IPs will not work most of the time.
In case Amazon's DNS service becomes unavailable we'll fail over to an external DNS service. This means you'll still have to configure the external IPs for the highest availability as an external DNS service will resolve the public IPs. This way you can ensure that your application is resilient towards DNS failures.
You can set up security group based access rules for your RDS security group. We've updated this knowledge base article with a section specifically for Amazon RDS where you can find the information necessary to set this up.