MVC application running on EC2 instance can't acess RDS database

Question

I'm developing an application with MVC that uses a remote database (RDS amazon) to populate the data of the application. Running the application locally everything works fine. The problem occurrs when I deploy the application to an EC2 instance, my online application can't acess the same RDS database. What is the correct procedure to enable the EC2 instance to acess the RDS database ? My security group has at inbound and outbound permissions for all trafic and anywhere enabled.

Answer 1

How do I resolve problems connecting to my Amazon RDS database instance?

Issue

I am unable to connect to my Amazon RDS database instance.

Your Problem:

When attempting to connect from an EC2 instance that is not in a VPC, the DB instance's security group is not configured to allow access by the EC2 instance.

Solution:

If attempts to connect from an EC2 classic instance fail, grant user access from the DB instance security group. For more information, check through the following:

If you want to access your DB instance from an Amazon EC2 instance, you must first determine if your EC2 instance and DB instance are in a VPC. If you are using a default VPC, you can assign the same EC2 or VPC security group that you used for your EC2 instance when you create or modify the DB instance that the EC2 instance will access.

If your DB instance and EC2 instance are not in a VPC, you must configure the DB instance's security group with an ingress rule that allows traffic from the Amazon EC2 instance. You would do this by adding the Amazon EC2 security group for the EC2 instance to the DB security group for the DB instance. In this example, you add an ingress rule to a DB security group for an Amazon EC2 security group.

Important

Adding an ingress rule to a DB security group for an Amazon EC2 security group only grants access to your DB instances from Amazon EC2 instances associated with that Amazon EC2 security group.

You can't authorize an Amazon EC2 security group that is in a different AWS region than your DB instance. You can authorize an IP range, or specify an Amazon EC2 security group in the same region that refers to IP address in another region. If you specify an IP range, we recommend that you use the private IP address of your Amazon EC2 instance, which provides a more direct network route from your Amazon EC2 instance to your Amazon RDS DB instance, and does not incur network charges for data sent outside of the Amazon network.

AWS Management Console

To add an EC2 security group to a DB security group

1. Sign in to the AWS Management Console and open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Select Security Groups from the navigation pane on the left side of the console window.

3. Select the details icon for the DB security group you want to grant access.

4. In the details page for your security group, select, select EC2 Security Group from the Connection Type drop-down list, and then select the Amazon EC2 security group you want to use. Then click Authorize.

5. The status of the ingress rule will be authorizing until the new ingress rule has been applied to all DB instances that are associated with the DB security group that you modified. After the ingress rule has been successfully applied, the status will change to authorized.

CLI

To grant access to an Amazon EC2 security group, use the AWS CLI command authorize-db-security-group-ingress.

Example

For Linux, OS X, or Unix:

aws rds authorize-db-security-group-ingress \
    --db-security-group-name default  \
    --ec2-security-group-name myec2group \
    --ec2-security-group-owner-id 987654321021 

For Windows:

aws rds authorize-db-security-group-ingress ^
    --db-security-group-name default  ^
    --ec2-security-group-name myec2group ^
    --ec2-security-group-owner-id 987654321021

The command should produce output similar to the following:

SECGROUP  Name     Description 
SECGROUP  default  default
      EC2-SECGROUP  myec2group  987654321021  authorizing

API

To authorize network access to an Amazon EC2 security group, call that Amazon RDS API function, http://docs.aws.amazon.com//AmazonRDS/latest/APIReference/API_AuthorizeDBSecurityGroupIngress.htmlAuthorizeDBSecurityGroupIngress with the following parameters:

EC2Security­GroupName = myec2group

EC2SecurityGroupOwnerId = 987654321021

Example

https://rds.amazonaws.com/
    ?Action=AuthorizeDBSecurityGroupIngress
    &EC2SecurityGroupOwnerId=987654321021
    &EC2Security­GroupName=myec2group
    &Version=2009-10-16
    &SignatureVersion=2
    &SignatureMethod=HmacSHA256
    &Timestamp=2009-10-22T17%3A10%3A50.274Z
    &AWSAccessKeyId=<AWS Access Key ID>
    &Signature=<Signature> 

Resource Link:

1. How do I resolve problems connecting to my Amazon RDS database instance?
2. Authorizing Network Access to a DB Instance from an Amazon EC2 Instance