Can't ping AWS RDS endpoint

Question

I want to migrate my local mysql database to Amazon RDS. But first I want to test to see if it is receiving communication. So I try to ping it. But the attempt timeout.

ping -c 5 myfishdb.blackOut.us-west-2.rds.amazonaws.com
PING ec2-54-xxx-xxx-118.us-west-2.compute.amazonaws.com (54.xxx.xxx.118): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3

I suspect that I need to open the inbound settings, so I open up the settings to

SSH TCP 22 72.xxx.xxx.xxx/32

And it still does not work. What do you suppose I am doing wrong? Am I missing anything else?

Why do you need SSH access? The whole idea of RDS is that the underlying architecture is managed for you. — Ja͢ck, Mar 24 '14 at 03:10
You will only be able to open port 3306 on an RDS security group. — datasage, Mar 24 '14 at 03:57

score 36 · Accepted Answer · edited Jan 28 '21 at 15:50

So I try to ping it. But the attempt timeout.

Ping won't work because the security group blocks all communication by default. You'll have to "poke holes" in the security group firewall to get traffic to your instance.

SSH TCP 22 72.xxx.xxx.xxx/32 And it still does not work.

Yup. RDS does not allow you to log in to the box via SSH. Only the MySQL port (3306) is open.

I want to migrate my local mysql database to Amazon RDS.

Ok, but be careful. DO NOT open up 3306 to the entire Internet (i.e. 0.0.0.0). MySQL was not designed for that, and often has flaws where anyone can break into your database.

You can open 3306 to just your (home) IP address (or the server you'll be using it from.) It should look like "5.5.5.5/32 TCP port 3306". But beware that this isn't great security because other people could see your packets. (MySQL supports encrypted connections, but you have to set them up explicitly.)

The best way to test a port is open is to telnet to the port. You can test your setup with telnet my.mysql.ip.address 3306. If you get no message, the port is not open. If you get "connected to ..", then your MySQL port is working.

The most secure way to use RDS is from an EC2 instance. You can create trust between the EC2 instance and the RDS security group. Your packets won't travel over the Internet, but only on the AWS network. Other people won't be able to see your packets, because nothing in EC2 allows that.

Docs imply you can't ping RDS instances regardless of your security group rules. — Geoffrey Wiseman, Sep 06 '16 at 14:15
Adding ICMP to the security group won't allow you to ping in some cases. I've got a SQL Server instance running in RDS; after adding 0.0.0.0/0 to allow ICMP IPv4, I wasn't getting a ping response. It's a confusing issue and probably a waste of time. The `telnet` approach worked for me. — Danny Bullis, Jul 17 '18 at 19:45
You can ping RDS you need to allow ICMP. You may also need to check firewall rules on the machine issuing the ping. If using Windows Powershell Test-NetConnection [IP] -Port [Port#] is also helpful. — iliketolearn, Jul 18 '22 at 20:55

score 13 · Answer 2 · answered Mar 24 '14 at 11:18

13

Amazon RDS is a managed service for relational databases. It does not give access to the low level infrastructure.

http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html

There is no SSH, Telnet or Ping access authorised to an RDS instance

Seb

answered Mar 24 '14 at 11:18

Sébastien Stormacq

14,301
5
41
64

1

telnet is a generic tool to open a connect to any port. "telnet with port" means you're connecting to the database port. Telnet port (TCP 23) and SSH port (TCP 22) ARE NOT enabled on Amazon RDS instances. – Sébastien Stormacq May 26 '20 at 07:56

score 12 · Answer 3 · answered Aug 13 '16 at 09:29

"RDS Instances are not configured to accept and respond to an ICMP packet for pings. The only way you can establish connectivity to your RDS instance is through a standard SQL client application."

This means, that adding ICMP rule into particular RDS security group, doesn't make your RDS instance reachable over ICMP.

score 2 · Answer 4 · answered Jun 29 '19 at 09:40

2

Ping is blocked as others have said. To allow Amazon RDS to connect from your EC2 instance. Go to Security groups of your RDS instance. Edit "Inbound" settings. And Change "Custom" to "Anywhere". After that you will be able to connect to db.

answered Jun 29 '19 at 09:40

Srihari Karanth

2,067
2
24
34

Thanks, changing it in the default security group worked for me. – ugola Apr 03 '23 at 00:12

score 1 · Answer 5 · answered Jun 19 '19 at 17:26

1

The solution that worked for me is open the IP:PORT in security group section

answered Jun 19 '19 at 17:26

Jorge Santos Neill

1,635
13
6

score 0 · Answer 6 · answered Mar 20 '23 at 07:08

0

Public access is supported from aurora serverless2.

https://aws.amazon.com/premiumsupport/knowledge-center/aurora-mysql-connect-outside-vpc/

answered Mar 20 '23 at 07:08

Jeff Gu Kang

4,749
2
36
44

score -1 · Answer 7 · answered Jun 08 '20 at 11:01

-1

You can use host from Linux, which is also what AWS says.

host <db_instance_endpoint>

This worked for me even when ping timed out.

answered Jun 08 '20 at 11:01

user984003

28,050
64
189
285

2

That's **not** what AWS says. AWS says: "To find the IP address of the Amazon RDS DB instance, use the host command". Finding the IP address of the RDS DB instance is not the same as connecting to it (like telnetting to the port does) – mikemaccana Jan 28 '21 at 15:49

score -3 · Answer 8 · answered Mar 24 '14 at 02:12

-3

AWS security groups block ICMP - which includes pings - by default. You'd have to open up ICMP - blindly trying to open TCP/22 isn't going to do anything.

answered Mar 24 '14 at 02:12

ceejayoz

176,543
40
303
368

1

Docs imply that RDS servers do not respond to pings even if you configure the security groups. – Geoffrey Wiseman Sep 06 '16 at 14:16

Can't ping AWS RDS endpoint

8 Answers8