Getting Connection time out error in Heroku connecting to RDS MySQL

Question

I am trying to connect to amazon RDS MySQL from Heroku using CodeIgniter PHP framework version 3. I followed all the steps listed in Heroku documentation about Amazon RDS but can't figure out what I am doing wrong?

Here are my CodeIgniter database settings:

$db['rds'] = array(
  'dsn' => '',
  'dbdriver' => 'mysqli',
  'dbprefix' => '',
  'pconnect' => FALSE,
  'db_debug' => (ENVIRONMENT !== 'production'),
  'cache_on' => FALSE,
  'cachedir' => '',
  'char_set' => 'utf8',
  'dbcollat' => 'utf8_general_ci',
  'swap_pre' => '',
  'compress' => FALSE,
  'stricton' => FALSE,
  'failover' => array(),
  'save_queries' => TRUE,
  'port' => 3306,
  'encrypt' => [
    'ssl_ca' => APPPATH."../.config/rds-combined-ca-bundle.pem",
    'ssl_verify' => TRUE
  ]
);
$db['rds']['hostname'] = getenv('RDS_DATABASE_HOSTNAME');
$db['rds']['username'] = getenv('RDS_DATABASE_USERNAME');
$db['rds']['password'] = getenv('RDS_DATABASE_PASSWORD');
$db['rds']['database'] = getenv('RDS_DATABASE_DBNAME');

But I keep getting this error:

mysqli::real_connect(): (HY000/2002): Connection timed out /app/vendor/codeigniter/framework/system/database/drivers/mysqli/mysqli_driver.php 201

Here is what I checked:

I checked in RDS security groups and CIDR/IP - Outbound 0.0.0.0/0 is there
I added a separate MySQL user with GRANT privileges SELECT,UPDATE,INSERT,DELETE and REQUIRE SSL
Added the combined certificate file to project root directory .config/rds-combined-ca-bundle.pem and deployed on Heroku
On local machine the same code works fine
Tried restarting the RDS instance

Where else should I look if some setting is wrong?

Chris Chris · Accepted Answer · 2018-10-03T13:56:10

Your CodeIgniter code needs to connect to your database, not the other way around. An outbound rule in your RDS security group won't help; you need an inbound rule (bold added):

You must grant Heroku dynos access to your RDS instance. The recommended way to do this is to configure the RDS instance to only accept SSL-encrypted connections from authorized users and configure the security group for your instance to permit ingress from all IPs, eg 0.0.0.0/0.

Since this effectively opens a hole in your firewall to the entire Internet it's very important to follow the rest of those instructions and only accept encrypted connections from authorized users.

Getting Connection time out error in Heroku connecting to RDS MySQL

1 Answers