Why can't I connect to a new AWS Aurora Serverless instance from my PC?

Question

Trying to set up a vanilla AWS RDS Aurora Serverless instance.

For now, I just want to connect to it directly from my PC as a sanity check, but I'm unable to do so. Every time I connect via $ mysql, it hands for a few minutes. Then I get:

$ mysql -h <MY-DATABASE>.cluster-deadbeef.us-west-1.rds.amazonaws.com -P 3306 -u admin -p
ERROR 2003 (HY000): Can't connect to MySQL server on '<MY-DATABASE>.cluster-deadbeef.us-west-1.rds.amazonaws.com' (60)

(nc also just times out)

Looks like there's a network connectivity I've made somewhere, but I'm not sure where.

Here's the entire setup (think I've included everything relevant?):

• Database Instance:

  $ aws rds describe-db-clusters --output json | jq '.DBClusters[0] | {AvailabilityZones, DBSubnetGroup, VpcSecurityGroups}'
  {
    "AvailabilityZones": [
      "us-west-1c",
      "us-west-1b"
    ],
    "DBSubnetGroup": "default-vpc-0165fd69fae5d2569",
    "VpcSecurityGroups": [
      {
        "VpcSecurityGroupId": "sg-051e6ad0fe8837a56",
        "Status": "active"
      }
    ]
  }
  

• VPC:

  $ aws ec2 describe-vpcs --output json | jq '.Vpcs[0] | {VpcId, CidrBlock, CidrBlockAssociationSet}'
  {
    "VpcId": "vpc-0165fd69fae5d2569",
    "CidrBlock": "10.0.0.0/16",
    "CidrBlockAssociationSet": [
      {
        "AssociationId": "vpc-cidr-assoc-0fe35851049a94f32",
        "CidrBlock": "10.0.0.0/16",
        "CidrBlockState": {
          "State": "associated"
        }
      }
    ]
  }
  

• VPC Subnets:

  $ aws ec2 describe-subnets --output json | jq '.Subnets[] | {AvailabilityZone,AvailabilityZoneId,CidrBlock,VpcId}'  
  
  {
    "AvailabilityZone": "us-west-1c",
    "AvailabilityZoneId": "usw1-az1",
    "CidrBlock": "10.0.1.0/24",
    "VpcId": "vpc-0165fd69fae5d2569"
  }
  {
    "AvailabilityZone": "us-west-1b",
    "AvailabilityZoneId": "usw1-az3",
    "CidrBlock": "10.0.0.0/24",
    "VpcId": "vpc-0165fd69fae5d2569"
  }
  

• Security Group:

  Yes this is totally wide open for now, still can't connect :(

  $ aws ec2 describe-security-groups --output json | jq '.SecurityGroups[]'
  {
    "IpPermissions": [
      {
        "IpProtocol": "-1",
        "IpRanges": [
          {
            "CidrIp": "0.0.0.0/0"
          }
        ],
        "Ipv6Ranges": [
          {
            "CidrIpv6": "::/0"
          }
        ],
        "PrefixListIds": [],
        "UserIdGroupPairs": [
          {
            "GroupId": "sg-051e6ad0fe8837a56",
          }
        ]
      },
      {
        "FromPort": 3306,
        "IpProtocol": "tcp",
        "IpRanges": [
          {
            "CidrIp": "0.0.0.0/0"
          }
        ],
        "Ipv6Ranges": [
          {
            "CidrIpv6": "::/0"
          }
        ],
        "PrefixListIds": [],
        "ToPort": 3306,
        "UserIdGroupPairs": []
      }
    ],
    "GroupId": "sg-051e6ad0fe8837a56",
    "IpPermissionsEgress": [
      {
        "IpProtocol": "-1",
        "IpRanges": [
          {
            "CidrIp": "0.0.0.0/0"
          }
        ],
        "Ipv6Ranges": [],
        "PrefixListIds": [],
        "UserIdGroupPairs": []
      }
    ],
    "VpcId": "vpc-0165fd69fae5d2569"
  }
  

• Route Table:

  $ aws ec2 describe-route-tables --output json | jq '.RouteTables[]'   
  {
    "Associations": [
      {
        "Main": true,
        "RouteTableAssociationId": "rtbassoc-0aebc4a882b0cd2a5",
        "RouteTableId": "rtb-0ce6ee26652736941",
        "AssociationState": {
          "State": "associated"
        }
      },
      {
        "Main": false,
        "RouteTableAssociationId": "rtbassoc-047d54469da606a50",
        "RouteTableId": "rtb-0ce6ee26652736941",
        "SubnetId": "subnet-0744475e288c0424c",
        "AssociationState": {
          "State": "associated"
        }
      },
      {
        "Main": false,
        "RouteTableAssociationId": "rtbassoc-08c5ea54642014c95",
        "RouteTableId": "rtb-0ce6ee26652736941",
        "SubnetId": "subnet-0b9c99ff38b860725",
        "AssociationState": {
          "State": "associated"
        }
      }
    ],
    "RouteTableId": "rtb-0ce6ee26652736941",
    "Routes": [
      {
        "DestinationCidrBlock": "10.0.0.0/16",
        "GatewayId": "local",
        "Origin": "CreateRouteTable",
        "State": "active"
      },
      {
        "DestinationCidrBlock": "0.0.0.0/0",
        "GatewayId": "igw-0f8ad7dfe1eaa0c67",
        "Origin": "CreateRoute",
        "State": "active"
      }
    ],
    "VpcId": "vpc-0165fd69fae5d2569",
  }
  

What am I missing?

thanks!!

Answer 1

For now, I just want to connect to it directly from my PC

You can not access serverless-DB from your local system, it is only accessible with-in AWS network.

You can configure ssh-tunnel through your EC2 instance to access serverless DB or use VPN that is running in the same VPC.

Because Aurora Serverless DB clusters do not have publically accessible endpoints, your MyClusterName can only be accessed from within the same VPC.

configure-connect-serverless-mysql-database-aurora