AWS RDS public access

15
votes

I am stumped with AWS configuration. My goal is to create a database that's accessible from inside and outside the network.

Here is what I have. RDS instance runs postgresql. Connections from inside the VPC work correctly.

The endpoint is set up to be publicly accessible - and when accessed from the outside, does in fact resolve. However, the connection hangs, indicating the traffic is blocked by somebody.

Security group is good:
Inbound: Port 5432 from 0.0.0.0/0 Outbound: all from 0.0.0.0/0

Subnets. I assume that's where something is wrong, right? At first I had two private and two public subnets in the subnet group. To simplify, I removed the private ones without changing the outcome.

So we have two public subnets:

subnet group

Both have the same route table with an Internet Gateway

subnet

internet gateway

As far as I can tell, everything is in working order... So who is blocking my database connection?

3
postgresqlamazon-web-servicesamazon-rds
Is there chance to check and see if your corporate firewall is blocking. Another check is to try launching a dummy ec2 instance in a totally different vpc and then trying to connect to the postgre rds- if ec2 approach works then it your firewall problem. I hope no acls are blocking ( VPC ACL) – Naveen Vijay
AWS has a horrible experience for configuring their services. It feels like engineers that have lost touch with the real world designed and wrote the documentation and are no longer able to consider writing for an audience that you know... doesn't know how to set things up. Incredible. – The Muffin Man

3 Answers

6
votes

Two things to check:

  1. Ensure that the RDS instance has the publicly accessible attribute set so that it is assigned a public address

  2. Also according to the AWS RDS docs, "If you want your DB instance in the VPC to be publicly accessible, you must enable the VPC attributes DNS hostnames and DNS resolution."

Also, check that the IP that your RDS instance hostname resolves to is a public IP address.

6
votes

As per new AWS RDS UI. Follow Following steps.

  1. Open the Amazon RDS console.
  2. Choose Databases from the navigation pane, and then select the DB instance.
  3. Choose Modify.
  4. Connectivity enter image description here

Additionally[important]: inbound and outbound policy update with PORT and IPs

1
votes

By default, even you have set "Public accessibility" to "Yes" during the setup of RDS, the "Security Group" still not allowing the port 3306 yet.

Therefore you have to click on the Security Group of the RDS, then add a Rule to allow 3306 from anywhere IP.

Here is the reference setting. But here I have to warn you first, this public accessibility would expose your database to the internet. Please do at your own risk.

enter image description here