(upbeat music)
- Hi, I am Arnab,
a Cloud Support engineer
here at the AWS office in Seattle.
Sometimes, customers tell me
that they are having issues
when connecting to the Amazon RDS instances.
Let's start with the basics about the Amazon RDS instances.
When customers spin up an instance or cluster
in an Amazon VPC.
Let's set up the Amazon VPC
with two subnets:
One public, and one private.
The Amazon RDS instances in the public subnet
can send outbound traffic directly to the Internet.
We can control the access to the Amazon RDS instance
using security groups.
A security group rule enables
a specific source to access
an Amazon RDS instance in an Amazon VPC that's associated
with that security group.
You can add rules to the security group
associated with the Amazon VPC
to allow traffic that is related to the source to travel
in and out of the DB instance.
When you set up the rule, you can specify an IP address,
a range of IP address,
or another security group in the VPC.
Let's also talk about the network access
control lists.
The ACLs,
network ACLs act as a firewall for resources
in a specific subnet in an Amazon VPC.
If you use ACLs in your Amazon VPC,
be sure that they have rules
to allow inbound and outbound traffic
traveling to and from
the DB instance.
Now, about network or the local firewalls.
Be sure to check with your network administration
to be sure that your network allows traffic
to and from the DB instance.
Note,
Amazon RDS does not accept Internet control message
protocol, ICMP, traffic, including ping.
Let me walk you through a few scenarios.
The RDS is in public subnet inside the VPC,
but the customer cannot connect
to the instance from a local desktop or workstation.
That is, the RDS can't be reached
or connected to over the Internet,
even though the RDS instance is in the public subnet.
To troubleshoot the situation,
let's check whether the RDS public accessibility
is set to yes.
If not, let's go through the steps to set
the public accessibility to yes.
After signing into the AWS management console,
navigate to the RDS console.
Let's click on the DB instances.
Select the RDS DB instance
that you want to change.
In this case, I'll be using
labmysql instance.
Choose modify.
On the modify page,
under network and security,
select the public accessibility option as yes.
When you have selected the option on the configuration,
choose apply immediately,
then choose modify.
Now let us wait for some time
while the instance becomes publicly accessible.
And then currently I can see the instances
in a modifying state.
Please note, when you select apply immediately,
any pending modifications
are also applied immediately,
instead of during the next maintenance window.
Thus, it may cause unexpected downtime.
It is recommended to check if there are any
pending maintenance actions
from AWS RDS console,
before proceeding.
As we can see now,
the RDS instances have a level at this time.
I'm clicking on the RDS instance
to see if the public accessibility
is set as yes.
So this is currently I can see it's set as yes,
so I will move over to the terminal window
to see if I'm able to connect with this RDS instance.
Yeah, I'm just using Telnet to connect to this
RDS instance over the port 3306.
Oops.
This is not connecting,
so let us see what our other options we have
in this scenario to connect with the RDS instance.
I'm moving over to the AWS RDS console.
Now let's check if the subnet route table
has an Internet gateway attached to it.
If it does not,
we need to attach the Internet gateway
and then check to see
whether your subnet route table
points to the Internet gateway.
Select the Amazon RDS DB instance that you want.
Choose connectivity and security.
And then choose Amazon VPC.
Here, my VPC is Demo1PUB only.
On the Amazon VPC console,
select the VPC
and then scroll down to the option below
and the route table attached to it.
On the route table page,
select the second tab routes,
and choose edit.
Select add route,
and add 0.0.0.0/0 sider range
to the destination,
and IGW to the target.
And choose save.
Now let us go back to the terminal window
and see if we are able to connect
to the this RDS instance
from the desktop.
I'll be using the same Telnet command
to connect to this RDS instance
on 3306.
Oops.
We see there are issues in the connectivity as well,
so let us see the security groups
for this particular RDS instance.
So I'll go back to the Amazon RDS console first,
I'll click on the DB instances.
So from the Amazon RDS console,
select the Amazon RDS DB instance
that you want to change.
Go to the connectivity and the security tab,
and then choose the VPC security group.
This takes you to the security group page
in the Amazon EC2 console.
Select the correct security group,
and then choose the inbound tab to edit the rules.
In the type,
select the correct protocol and port,
and then select my IP from the source list.
You can add an optional description as well
and this populates the local desktop IP.
Choose save.
And then try to connect from the desktop.
So I'll go back to the terminal page one more time
to see if I can connect to the RDS instance.
I'll be using the same Telnet command
to see if the traffic is reaching
from my desktop to the RDS instance.
Wow, it's connecting,
so we can see the RDS instance is reachable
from my local desktop
and we did change the public accessibility to yes.
We saved the route table with the proper Internet gateway,
and we allowed the permission from the local desktop IP
to the security groups.
And let me try to connect to this instance
using mysql.
As you can see here,
I'm using the mysql utility
to connect to this RDS instance.
On the port 3306, my username is aws_demo.
Yes, I'm able to connect to this RDS instance.
Please note, often when we change the network,
whether we're using a VPN,
our office network, or our home network,
the work station, the laptop IP address also changed.
When this happens,
it is of best practice to add the correct
IP address in the security group
in the same way as described above.
Let's go back to the second scenario.
The Amazon RDS is in a private subnet and you cannot connect
to it from your local desktop.
This happens when RDS is run in a private subnet,
usually for the security reasons.
Sometimes, this means that there can be difficulties
when connecting from the local desktop.
But the reason that Amazon RDS is located within
a private subnet is so that it can be accessed only within
the VPC network or through the VPN connection
from the local network.
In this scenario, it is a best practice
to use an Amazon EC2 instance
inside the same VPC.
Then try to connect to the RDS instance
or set up a VPN network connection
between your Amazon VPC and your local network.
Add the Amazon EC2 instance IP
or the security group of the EC2 instance,
or your local network CIDR range
for VPN connections
to the Amazon RDS security group.
From the Amazon RDS console,
select the Amazon RDS DB instance
that you want to change.
In this case, I'll be using
demomysqlpriv.
Go to the connectivity and security tab
and choose the security group.
This will take you to the security group page
in the Amazon EC2 console.
Select the correct security group
and choose the inbound tab to edit the rules.
In type,
select the right protocol, port,
and select the security group of the Amazon EC2 instance,
or the IP address of the Amazon EC2 instance.
For this test case,
I have one EC2 instance in the same region
and the security group of the EC2 instance
is pub SG.
I'll be using the same EC2 instance
to connect to the RDS instance,
hosted in the private subnet.
I'm selecting all traffic
from the security group, pub SG,
in which the EC2 instance is hosted.
You can also add optional description if you like.
Choose save,
and then try to connect to the RDS instance
from the Amazon EC2 instance.
Let us go back to the terminal
from where we will connect to the EC2 instance
and we will try to connect with the RDS instance,
hosted in the private subnet.
I'm connecting to the EC2 instance
from the terminal.
I'll be using Telnet
to connect to the RDS instance over the port 3306.
It worked, so we are able to reach to the RDS instance
hosted in the private subnet from the EC2 instance.
Let us try to connect using the mysql utility as well.
Yes, we are able to connect from the mysql utility as well.
Now, let's discuss about one more scenario
where the Amazon RDS is in the different
Amazon VPC than the Amazon EC2 instance
and customer cannot connect.
In this scenario, Amazon RDS
is accessed from an Amazon EC2 instance,
and they exist in different Amazon VPCs.
The customer needs to enable a connection
between two Amazon VPCs that enables traffic to be routed
between them.
Please note,
when you have an Amazon VPC peering connection
between VPC A and VPC B,
which can belong to the same or different
AWS account, you should not be having
overlapping CIDR blocks.
For this test scenario,
I'll be using two VPC,
one in the Mumbai region,
and the one in the central region.
My RDS will be hosted in the Mumbai region,
and the EC2 instance is hosted in the central region.
For that,
I will try to establish a VPC peering connection at first.
Let's get started.
From the Amazon VPC console,
select peering connection from the menu
on the left-hand side.
Choose create peering connection
and give a name tag,
give the VPC of the Amazon RDS instance,
and you will need to select
another VPC to peer with.
Then choose the account.
Here, I'll be choosing my account.
I'll choose the region.
In this case, it will be another region,
and I'll be selecting the region which is hosted in central.
And I have to give the VPC ID of the accepter VPC.
And choose create peering connection.
Go to the route table
of the Amazon VPC console.
Once you have created the peering connections,
we can see the status is in a pending state,
so we have to go to the different VPC in the central region.
Click on peering connection,
and we can see this is also pending state.
We have to accept this peering connection.
I'm clicking on actions,
and accept request.
Accept the VPC peering connection request.
Yes, accept.
So this message gives us
the VPC peering connection has been established
between the two VPC hosted one in Mumbai region,
and the other one in central region.
We can see the VPC peering connection status
is active right now in central.
Let's go back to the VPC section
in Mumbai region.
Let us refresh this page.
And we can see the status is currently active.
Go to the route tables on the Amazon VPC console
and then change the route tables to access
the entire CIDR block of another VPC.
Now I will add the destination
to the Amazon EC2 VPC main route table.
Select the route table on the Amazon VPC dashboard.
Search for the EC2 VPC ID,
and choose edit but under the routes tab.
Choose add another route.
Enter the CIDR range of the Amazon RDS VPC
for the destination,
and enter the ID of the peering connection
for the target,
and click on save routes.
Now we will add the destination
to the instance or the class for VPC main route table.
Go back to the VPC,
where the RDS instance is hosted.
I will select the route tables
in the Amazon VPC dashboard.
I'll select for the VPC ID,
and I will click edit but under the routes tab.
I will choose add another route
and I will enter the entire CIDR range for the VPC
for the destination.
I need to enter the ID of the peering connection
for the target.
And click on save routes.
You can update the inbound or the outbound rules
for your VPC security groups
to reference the security groups in the peered VPC.
Doing so allows the traffic to flow
to and from the instances
that are associated with the referenced security group
in the peered VPC.
I'll go to the RDS AWS console.
I've clicked on the DB instance,
and I will see the security group
for the DB instance is default.
And to update the security group rules,
using the console,
we will open the Amazon VPC console.
In the navigation pin,
we will choose security groups.
Select the security group and choose the inbound rules
to modify the inbound rules or the outbound rules.
Choose edit
and add another rule.
Specify the type, the protocol,
the port range as required.
For source, our destination for an outbound rule,
type the ID of the security group in the peered VPC
if it is in the same region
or the CIDR block of the peered VPC if it's in
a different region.
So I'll quickly go back to the EC2 instance,
which is hosted in central region,
and I will try to find the IP of this instance.
I see the private IP of the instance is 172.0.1.4.
I come back to the security groups
and I will add this private IP in the inbound rules.
We can add a short description as well
for this particular rule.
Now click choose save rules.
Now we will go back and we will try to connect
with the EC2 instance from the terminal.
The EC2 instance is hosted
in the central region,
and from the EC2 instance,
we will try to connect
to the RDS instance
hosted in the Mumbai region.
I'm trying to connect with the EC2 instance,
which is hosted in the central region.
Now let's try to connect with the RDS instance,
which is hosted in the Mumbai region.
Yes, we can see it is connecting,
so by this weekend, establish the connectivity
from the EC2 instance, which is hosted
in a VPC in central region,
to an RDS instance,
which is hosted in the Mumbai region.
Two VPC peering.
So I will try to connect to this RDS instance
using the mysql utility.
Yes, we are able to establish the connection
using the mysql utility as well.
Thanks for watching,
and happy cloud computing
from all of us here at AWS.
(upbeat music)