AWS RDS public access

Question

I am stumped with AWS configuration. My goal is to create a database that's accessible from inside and outside the network.

Here is what I have. RDS instance runs postgresql. Connections from inside the VPC work correctly.

The endpoint is set up to be publicly accessible - and when accessed from the outside, does in fact resolve. However, the connection hangs, indicating the traffic is blocked by somebody.

Security group is good:
Inbound: Port 5432 from 0.0.0.0/0 Outbound: all from 0.0.0.0/0

Subnets. I assume that's where something is wrong, right? At first I had two private and two public subnets in the subnet group. To simplify, I removed the private ones without changing the outcome.

So we have two public subnets:

Both have the same route table with an Internet Gateway

As far as I can tell, everything is in working order... So who is blocking my database connection?

Solution 1

By default, even you have set "Public accessibility" to "Yes" during the setup of RDS, the "Security Group" still not allowing the port 3306 yet.

Therefore you have to click on the Security Group of the RDS, then add a Rule to allow 3306 from anywhere IP.

Here is the reference setting. But here I have to warn you first, this public accessibility would expose your database to the internet. Please do at your own risk.

Solution 2

As per new AWS RDS UI. Follow Following steps.

1. Open the Amazon RDS console.
2. Choose Databases from the navigation pane, and then select the DB instance.
3. Choose Modify.
4. Connectivity

Additionally[important]: inbound and outbound policy update with PORT and IPs

Solution 3

Two things to check:

1. Ensure that the RDS instance has the publicly accessible attribute set so that it is assigned a public address

2. Also according to the AWS RDS docs, "If you want your DB instance in the VPC to be publicly accessible, you must enable the VPC attributes DNS hostnames and DNS resolution."

Also, check that the IP that your RDS instance hostname resolves to is a public IP address.

Comments

[Naveen Vijay]

Is there chance to check and see if your corporate firewall is blocking. Another check is to try launching a dummy ec2 instance in a totally different vpc and then trying to connect to the postgre rds- if ec2 approach works then it your firewall problem. I hope no acls are blocking ( VPC ACL)

[The Muffin Man]

AWS has a horrible experience for configuring their services. It feels like engineers that have lost touch with the real world designed and wrote the documentation and are no longer able to consider writing for an audience that you know... doesn't know how to set things up. Incredible.

[Elias Strehle]

Thanks @Naveen Vijay! In my case the firewall was blocking outgoing requests to port 3306.

[Arvind K.]

Most looking for answer to this would know this in general. I would have liked if you explained whatever you marked red and whether this plays any role in public access connectivity

[Arvind K.]

If I have had time to read those "detailed" Amazon docs I would not look for quick and effective answer. This is what most would have already known.

[Ben Whaley]

If you won't read the docs then you'll never be able to learn anything for yourself.

[iurii]

"Also, check that the IP that your RDS instance hostname resolves to is a public IP address." - how to check this?