How do I resolve problems when connecting to my Amazon RDS DB instance?

6 minute read

I can't connect to my Amazon Relational Database Service (Amazon RDS) DB instance.

Short description

There are a number of root causes for the inability to connect to an Amazon RDS DB instance. Here are a few of the more common reasons:

The RDS DB instance is in a state other than available, so it can't accept connections.
Your source to connect to the DB instance doesn't have authorization access in your security group, network access control lists (ACLs), or local firewalls.
The wrong DNS name or endpoint is used to connect to the DB instance.
The Multi-AZ DB instance failed over, and the secondary DB instance uses a subnet or route table that doesn't allow inbound connections.
The user authentication is incorrect because of one of the following reasons:
You're using an incorrect user name or password at the database level to access the instance from the DB client.
You don't have the required database permissions to access the instance.
The client is running on a version that's incompatible with the database version.

Tip: You can use the following troubleshooting steps to identify the source of the connectivity issue. Or you can use the AWSSupport-TroubleshootConnectivityToRDS AWS Systems Manager Automation document to diagnose the issue for you. This automation document can diagnose network ACLs based on the primary IP address of the Amazon Elastic Compute Cloud (Amazon EC2) instance. However, ephemeral ports aren't verified. The automation doc also checks security groups based on the primary IP address of the EC2 instance, but that automation doesn't check specific ports. For more information, see Run an automation.

Resolution

Be sure that your DB instance is in the available state

If you recently launched or rebooted your DB instance, then confirm that the DB instance is in the available state in the Amazon RDS console. Depending on the size of your DB instance, it can take up to 20 minutes for the DB instance to become available for network connections.

If your DB instance is in the failed state, see Why is my Amazon RDS DB instance in a failed state?

Be sure that your DB instance allows connections

Be sure that traffic from the source connecting to your DB instance isn't gated by one or more of the following:

Any Amazon Virtual Private Cloud (Amazon VPC) security groups associated with the DB instance. If necessary, add rules to the security group associated with the VPC that allow traffic related to the source in and out of the DB instance. You can specify an IP address, a range of IP addresses, or another VPC security group. For general information about VPC and DB instances, see Scenarios for accessing a DB instance in a VPC.
Any DB security group associated with the DB instance. If the DB instance isn't in a VPC, then the instance might be using a DB security group to gate traffic. Update your DB security group to allow traffic from the IP address range or Amazon EC2 security group that you use to connect.
Connections outside a VPC. Be sure that the DB instance is publicly accessible and associated with a public subnet (for example, the route table allows access from an internet gateway). For more information, see Scenarios for accessing a DB instance in a VPC.
If your DB instance is in a private subnet, be sure to use VPC peering or AWS Site-to-Site VPN to connect to your instance securely. With Site-to-Site VPN, you configure a customer gateway that allows you to connect your VPC to your remote network. You can use VPC peering by creating a peering connection between your source VPC and your instance's VPC to access the instance from outside its VPC. You can also use an Amazon EC2 instance as a bastion (jump) host.
Network ACLs. Network ACLs act as a firewall for resources in a specific subnet in a VPC. If you use ACLs in your VPC, then be sure that they have rules that allow inbound and outbound traffic to and from the DB instance.
Network or local firewalls. Ask your network administrator if your network allows traffic to and from the ports that the DB instance uses for inbound and outbound communication.
Note: Amazon RDS doesn't accept internet control message protocol (ICMP) traffic, including ping.

Troubleshoot potential DNS name or endpoint issues

When connecting to your DB instance, you use a DNS name (endpoint) provided by the Amazon RDS console. Be sure to use the correct endpoint. Also, provide the endpoint in the correct format to the client that you use to connect to the DB instance. For more information on DB engine connections and how to use an endpoint in various client applications, see Getting started with Amazon RDS.

For example, use nslookup to the DB instance endpoint from an Amazon EC2 instance within the VPC:

nslookup myexampledb.xxxx.us-east-1.rds.amazonaws.com 
Server: xx.xx.xx.xx 
Address: xx.xx.xx.xx#53

See the following example of a non-authoritative answer:

Name: myexampledb.xxxx.us-east-1.rds.amazonaws.com 
Address: 172.31.xx.x

Troubleshoot database level issues

Be sure that you're using the correct user name and password to access the instance from your DB client.
Be sure that the user has the database permissions to connect to the DB instance.
Check for any resource throttling in Amazon RDS, such as CPU or memory contention. This contention might lead to issues with establishing newer connections to the instance.
Be sure that the instance hasn't reached the max_connections limit.

Check the route tables associated with your instance

When you create a Multi-AZ deployment, you launch multiple replica DB instances in different Availability Zones to improve the fault tolerance of your application. Be sure that the subnets associated with each DB instance are associated with the same or similar route tables. If your primary DB instance fails over to a standby replica that's associated with a different route table, then traffic might not be routed correctly. Even if that traffic was previously routed without an issue, it might no longer be routed correctly.

For more information about configuring route tables, see Configure route tables. For additional information about Multi-AZ deployments, see Multi-AZ deployments for high availability.

Note: If you can connect to your DB instance but you get authentication errors, see How do I reset the master user password for my RDS DB instance?

Verify the connectivity

Verify your connection by running one of these commands:

telnet <RDS endpoint> <port number>
nc -zv <RDS endpoint> <port number>

If either the telnet or nc commands succeed, then a network connection was established. This means that the issue is likely caused by the user authentication to the database, such as user name and password.