Cannot connect to RDS from EC2 Instance - VPC access already allowed

0
votes

I am trying to connect to RDS SQL Server from my EC2 Instance (and they are in the same VPC).

As far as I understood, as long as RDS and EC2 are in the same VPC, I just need to ensure EC2 security group allows traffic from port 1433 (SQL Server); and RDS security group to allow EC2 Access. I have configured my set up as below:

Under VPC Name 'xyz' - I have two security group names 'ec2' and 'rds'. Configuration details:

'ec2' security group: Inbound rules allow port 1433 to access.
'rds' security group: Allow 'All ICMP - IPv4','All TCP' and 'All UDP' for 'ec2' security group.

I tried connecting to RDS from my EC2 Instance using SQL Management Studio (server name as rds.blah.blah...amazonaws.com,1433; with sql server authentication) but failed. The error message I received was:

'A network-related or instance-specific error occured while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No such host is known.) (Microsoft SQL Server, Error: 11001) No such host is known'

Just wondering if anyone can point out where I did wrong? Your help would be much appreciated!

1
amazon-web-servicesamazon-ec2amazon-rds
If anything you opened the security groups more than you needed to. Are you sure the 'ec2' group is actually assigned to the EC2 instance, and the 'rds' group is actually assigned to the RDS instance? – Mark B
all looks good; u might be making some silly mistake – Deepak Singhal

1 Answers

2
votes

You misunderstood the ec2 and rds security groups' inbound and outbound rules. It doesn't make sense to me to set ec2 security group with Inbound rules allow port 1433 to access.

The related security group settings are list below, Review if you do the same:

ec2 security group

set outbound (egress) rules to 

Type: All traffic
Protocol: All
Port Range: All
Destination: 0.0.0.0/0

This will not limit any outbound traffic, you can adjust later to narrow it down

rds security group

set inbound (ingress) rules to 

Type: MS SQL
Protocol: TCP
Port Range: 1433
Source: ec2 security group id (sg-xxxxxx)

Comments by @John Rotenstein: This means that any EC2 instance that is associated with that EC2 security group will be permitted to access RDS on port 1433