AWS - trying to read update RDS sql server parameter file

The AWS CLI doesn't connect directly to your RDS database instance when modifying parameter groups - it communicates with the AWS API endpoints instead. This means the connectivity issue you're experiencing isn't related to your database security group or port 1433.

When you use the AWS CLI to modify an RDS parameter group, you're making API calls to AWS services, not database connections. The CLI needs proper AWS credentials and permissions (IAM), as well as network access to AWS API endpoints.

To modify a DB parameter group using the AWS CLI, use the modify-db-parameter-group command with the required options:

• --db-parameter-group-name (the name of your parameter group)
• --parameters (the parameters you want to modify)

For example, you might run something like:

aws rds modify-db-parameter-group --db-parameter-group-name your-parameter-group-name --parameters "ParameterName=parameter_name,ParameterValue=new_value,ApplyMethod=immediate"

If you're getting connection errors with the AWS CLI, check:

1. Your AWS credentials are properly configured (via aws configure or environment variables)
2. Your IAM user/role has the necessary RDS permissions (like rds:ModifyDBParameterGroup)
3. Your network allows outbound HTTPS traffic to AWS API endpoints
4. You're using the correct AWS region in your CLI command

The security group rules you mentioned are only relevant for connecting to the database itself, not for AWS CLI operations.
Sources
Modifying parameters in a DB parameter group in Amazon RDS - Amazon Relational Database Service

1. Connectivity from the bastion server to the AWS API

# Check if the AWS API is reachable via the internet
curl -v https://rds.<your-region>.amazonaws.com

# Check if DNS resolution is working
nslookup rds.<your-region>.amazonaws.com

2. If the bastion server is in a private subnet

The AWS CLI cannot reach the RDS API endpoint if there is no route via an Internet Gateway or NAT Gateway. In this case, one of the following is required:

• Enable internet access via a NAT Gateway

• OR create a VPC Interface Endpoint (PrivateLink) for RDS to allow access to the AWS API (rds.amazonaws.com) via a private route from the private subnet

aws ec2 create-vpc-endpoint \
--vpc-id <your-vpc-id> \
--service-name com.amazonaws.<region>.rds \
--vpc-endpoint-type Interface \
--subnet-ids <subnet-id> \
--security-group-ids <sg-id>

The security group for this VPC endpoint must allow traffic on port 443 from the bastion server (not port 1433).

Could you please provide the specific error message? Knowing the exact details of the "connection error" (e.g., "Could not connect to the endpoint URL," "timeout," "Unable to locate credentials," etc.) will help in troubleshooting more accurately. If possible, please share the command you executed and the full error message.