I created a new SQL Server Express with 'admin' username & password.
I added inbound rules in Security Groups to allow all traffic from my laptop's IP address & default gateway (Do I need to do both Ipv4 address & also the gateway for connectivity to go thru?)
When I tried to connect to the newly created SQL Server via SSMS using SQL Server authentication with username admin & password that I used while creating the Instance. The connection fails with the error message below. What am I doing wrong?
TITLE: Connect to Server
Cannot connect to sql-xxxxxxxxxxxxx.rds.amazonaws.com.
A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server) (Microsoft SQL Server, Error: 53)
Check Public access for RDS Instance: You are trying to access the RDS instance from your laptop - means trying to access RDS from outside VPC that is hosting the instance. In that case you must enable public access to the RDS instance. This would assign a public IP. You can modify this feature after creating the RDS instance too.
Security Group rules: Port 1433 must be opened for the IP address you would like to access from - your home/work IP address. You can select 'My IP' on source when creating Security Group rules, this will set your IP automatically as source.
PS: Please make sure the subnet where RDS instance is hosted does not have any blocks at NACL level and subnet's route table has route to internet traffic, through Internet Gateway.
Related
I'm trying to set up an SFTP server managed by AWS that has a fixed IP address which external clients can whitelist in a firewall. Based on this FAQ this is what I should do:
You can enable fixed IPs for your server endpoint by selecting the VPC endpoint for your server and choosing the internet-facing option. This will allow you to attach Elastic IPs (including BYO IPs) to your server’s endpoint, which is assigned as the endpoint’s IP address
So I followed the official instructions here under "Creating an Internet-Facing Endpoint for Your SFTP Server". The creation settings look like this:
The result looks like this:
Compare with the result screenshot from the docs:
(source: amazon.com)
My result is almost the same, except that under the table "Endpoint Configuration" the last column says "Private IPv4 Address" instead of 'Public'. That's the first red flag. I have no idea why it's a private address. It doesn't look like one, it's the IP address of the Elastic IP that I created, and the endpoint DNS name s-******.server.transfer.eu-west-1.amazonaws.com resolves to that IP address on my local machine.
If I ping the endpoint or the IP address, it doesn't work:
451 packets transmitted, 0 received, 100% packet loss, time 460776ms
If I try connecting with sftp or ssh it hangs for a while before failing:
ssh: connect to host 34.****** port 22: Connection timed out
Connection closed
The other potential problem is security groups:
At this point, your endpoint is assigned with the selected VPC's default security group. To associate additional or change existing security groups, visit the Security Groups section in the https://console.aws.amazon.com/vpc/.
These instructions don't make sense to me because there's nowhere in the Security Groups interface that I can assign a group to another entity such as a transfer server. And there's nowhere in the transfer server configuration that mentions security groups. How do I set a new security group?
I tried changing the security group of the Network Interface of the Elastic IP, but I got a permission error even though I'm an administrator. Apparently I don't actually own ENIs? In any case I don't know if this is the right path.
The solution was to find the endpoint that was created for the server in the "Endpoints" section of the VPC console. The security groups of the endpoint can be edited.
The "Private IPv4 address" seems to be irrelevant.
The default security group controls access to the internet-facing endpoint for the new sftp server in a vpc. Mess around with the default security group ingress rules for the vpc selected for the sftp server. Or, white list the exact ip address connecting to the sftp endpoint in the default security group.
If the admin says ho hum, create a second vpc for the sftp server if isolation is absolutely necessary. Fiddle with the default group in the new, isolated vpc.
Link:
Creating an Internet-Facing endpoint for Your sftp server
Happy transferring!
I have an AWS Lambda function for an API. I have a test function inside of the API that returns a "Success" string so I know that I can hit the API from my machine (Postman).
The Lambda API is inside of my VPC. I have public and private subnets. The API is living in the public subnets. I also have a RDS database that's living in the private subnets. I can connect to the database through a Bastion host so I know the database is connected and working.
When I try an API call that connects to the database, I can see an error in CloudWatch that says:
[Error] Amazon.Lambda.AspNetCoreServer.APIGatewayProxyFunction: Unknown error responding to request: MySqlException:
MySql.Data.MySqlClient.MySqlException (0x80004005): Unable to connect to any of the specified MySQL hosts. ---> System.InvalidOperationException: Sequence contains more than one matching element
There's a lot of references to that error message that talks about the Linq SingleOrDefault() method, but I don't have any references to that method.
I think that error has something to do with the security groups. I have an RDS security group that has an inbound rule on port 3306 from my internal VPC ip addresses.
The security group for my Lambda function should be ok since I can successfully hit the test route.
Finally, I tried connecting to the database through the API in debug on my machine and I get an error "The requested name is valid, but no data of the requested type was found"
Does anyone have any other ideas or places to look?
Can you check your this setting is enable or not for RDS Security group ?
Disclaimer : Allowing inbound traffic on DB from internet is not recommended and should always be avoided
My RDS database (that I was trying to connect to and read from using AWS Lambda) was also a MySQL database.
When I tested the Lambda function I was getting 'Unable to connect to any of the specified MySQL hosts' (after waiting -- like it was timing-out).
I reviewed the answer from #aviboy2006, which helped me. I tried all the Security Group rules shown in that answer. I found I was able to successfully connect-to and read from the RDS MySQL database when I defined both an Inbound and Outbound rule for the associated VPC Security Group as
Type: MYSQL/Aurora
Protocol: TCP
Port Range: 3306
Source: Custom: 0.0.0.0/0
I was able to connect to the amazon rds aurora database locally, and run queries.
But on production EC2 server, the connection returns 500 server error "SQLSTATE[HY000] [2002] Connection timed out".
I've added the same credentials for the database to production, and can see they are being used in the error log.
I enabled the 'allow public access' setting.
I added all the security groups I have to the database (this is probably the problem, I didnt create any special groups, just whatever amazon suggested I let them do).
How could it be working locally but not on production?
Can you check your production server security group outbound rules. if it is connecting from local and not connecting from production machine , so should be some outbound traffic timeout.
It was a security group issue.
The default rds-setup-wizard security group was applied to my database instance, and this gave me local access. I guess it had my ip address or similar as an inbound rule.
I had to add a new security group and add that new group to the database instance.
My new security group needed an inbound rule that looked like this:
Type: MYSQL/Aurora
Protocol: TCP
Port Range: 3306
Source: my EC2's private ipv4 address with /32. Eg: 13.14.15.16/32
I'm studying AWS.
But I have a problem that I cannot connect to my web server on my AWS instance
AWS instance is Windows Server 2012
this is my instance status
I want to connect my web server via public ip 52.78.47.142 outside the AWS instance
if I connect to the private ip 172.31.15.206 inside the instance, home page showed up.
But if I connect to the public ip 52.78.47.142 inside the AWS instance and outside the AWS instance, home page didn't show up both.
although I set a new rule for http protocol at port 80, it doens't work
any helps? thanks a lot...
open up tcp:80 port in the security group(Inbound) for the IP address of the machine from where your accessing the website( In this case your Desktop or Laptop IP address).
If you are trying to access the web server from another AWS Instance open the port for that particular Instance IP. For troubleshooting case you can open up All traffic and test it(Though this is not recommended)
Am following this tutorial
http://thoughtsandideas.wordpress.com/2012/05/17/monitoring-and-managing-amazon-rds-databases-using-mysql-workbench/
I am not able to Test DB Connection while creating new server instance to connect to the RDS database.
It says Bad_Authentication[allowed_types=public_key], i have a tried different .pem files and have done through a lot of forums.
I have also allowed access to my IP in the DB SecurityGroups for RDS and the Security Groups for EC2.
Please help me out. Thanks.
This worked for me. Assuming you have logged into AWS:
Go to RDS -> Databases -> Select your database
Make sure the Public Accessibility value is Yes
Check your IP address using http://checkip.amazonaws.com/. If it is not added to the Security Rule Groups, you should add it. this step is crucial
3.1. Click on the rule name. This will open up a new tab, then click in the name of the rule.
3.2. Click on Edit inbound rules
3.3. Click on Add new rule, and add a rule with the following values:
Type: MYSQL/Aurora.
Protocol: TCP (default)
Port range: 3306 (default)
Source: My IP -> This will be the IP Address you got at http://checkip.amazonaws.com/.
Fill information in MySQL Workbench
Hostname: Use the value you have for Endpoint at Connectivity and Security
Port: Use the value you have for Port at Connectivity and Security, by default it is 3306.
Username: Use the value you have for master username at Configuration
Password: Use the value you set when you created the database instance.
If you forgot the password, you can change it by clicking on Modify in your database instance)
I hope this also helps you.
In my scenario the problem was simple
I had to enable 3306 port for MYSQL in the related Security group in RDS > db instance section.
For RDS no need to use ssh. You can directly connect the RDS with MySql workbench.
Follow the following steps-
Make sure that in Security Group you should have provide access for MYSQL
Open MySQL workbench and setup New Connection.
Provide a Connection Name.
Connection Method is set to Standard (TCP/IP)
In the HostName provide your RDS end point
Port is 3306
Enter the username what you have given in the RDS.
Test Connection, and provide the password.
That's it.
For Reference GoTo This Link
If you are not using EC2 Instance to connect with RDS DB Instance then DB Instance should have public access to connect.
While launching DB Instance you need to set Publicly Accessible to yes. You will get Public IP to connect from outside network. That means outside of VPC.
You need to launch DB Instance in Public Subnet which has directly access to Internet. To check Subnet has Internet access, you need to check Route Table which was attached with the subnet. In Route table, check Internet Gateway is attached to the subnet.
You don't need to SSH into DB Instance. Though the option is not available also.
In MySQL WorkBench, click on Setup New Connection.
Give connection name. Choose Standard (TCP/IP) option. You are not trying to connect DB Instance over EC2 Instance so the option with SSH with not work out in this case. You have to provide MySQL hostname, username, password and port.
To verify connection, click on Test Connection button.
If you want to use EC2 Instance and connect DB Instance over EC2 Instance, you have to use Standard (TCP/IP) over SSH option. Check the following link
What would prevent me from connecting to a MySQL server on AWS RDS from an AWS EC2 VM?
I had the same issue. I think you need to enable inbound traffic to the VPC. Follow the below article and you'll be fine. Default VPC is not allowing users to access 3306 by default and you need to allow traffic.
RDS and MySQL Connectivity
Make sure Public accessibility should be yes.
Also, Inside security Group section, click on the security link and then add a new rule under inbound rule section which will whitelist your IP address with the below data :
Type: MYSQL/Aurora.
Protocol: TCP (default)
Port range: 3306 (default)
Source: My IP -> This will be the IP Address you got at http://checkip.amazonaws.com/.
Hope this will help to connect with AWS RDS successfully. Thanks!
Based on the details in your question, it seems that you are trying to SSH into the RDS instance. This is not supported on RDS, it only works for EC2 based MySQL servers.
You should instead connect directly to the MySQL server, on port 3306 (or the one you set manually, if this is the case) and using the username and password you created when provisioning the RDS instance. This means using the Connection Type "Standard TCP/IP" in WB.
Also, the public IP address of the machine you're using MySQL Workbench on should be allowed in the RDS security group.
Even I had the same issue, like after trying all the things out there. A thing worked is modifying the RDS database and making it publically accessible. That sorted things out.
All of the other answers are extremely helpful to debug the connection process but for me the literal fix was to not put in the password into the keychain when initializing the MySQL Connections. Instead, I pressed Test and put in the password when prompted to do so. Running on macOS Monterey V.12.3.1 with a MBP M1, 2020