Unable to connect to RDS MariaDB instance - connection hangs/times out

Based on your description, here are additional troubleshooting steps to diagnose the connection timeout issue:

Security Group Verification: Since you mentioned multiple security groups are attached to your RDS instance, verify that ALL security groups associated with the instance allow inbound traffic on port 3306 from your IP. If any security group has restrictive rules, it can block the connection even if another security group allows it. Check the RDS console to see exactly which security groups are attached and review each one's inbound rules.

Correct Endpoint and Port: Double-check that you're using the correct endpoint from the RDS console. Verify there are no typos in your connection string. Since you mentioned the instance is Multi-AZ, ensure you're connecting to the primary endpoint and not accidentally using an old or incorrect endpoint.

Network Path Testing: Use telnet or nc (netcat) to test basic TCP connectivity to port 3306:

telnet my-rds-endpoint.eu-west-1.rds.amazonaws.com 3306

or

nc -zv my-rds-endpoint.eu-west-1.rds.amazonaws.com 3306

If this times out, it confirms a network-level issue rather than a database authentication problem.

VPC Route Tables: Even though you're using the default VPC with an internet gateway, verify the route table associated with the subnet where your RDS instance resides. Ensure there's a route for 0.0.0.0/0 pointing to the internet gateway (igw-xxxxx).

Subnet Configuration: Confirm that your RDS instance is in a public subnet (one with a route to an internet gateway) if you're connecting from outside AWS. Check the subnet associations in the VPC console.

Corporate/ISP Firewall: Even though you've checked your local firewall, your corporate network or ISP might be blocking outbound connections to port 3306. Try connecting from a different network (such as a mobile hotspot) to rule this out. Alternatively, if your company has firewall rules blocking port 3306, you could recreate the instance using a different port.

CloudWatch Metrics: Check CloudWatch metrics for your RDS instance, particularly DatabaseConnections and FailedSQLServerAgentJobsCount, to see if there are any patterns or errors being logged.

RDS Event Log: Review the RDS Events in the console for your instance to see if there are any system-level issues or maintenance activities that might be affecting connectivity.

Enhanced Monitoring: If not already enabled, consider enabling Enhanced Monitoring for more detailed metrics about the instance's performance and resource utilization.

If these steps don't resolve the issue and the telnet/nc test fails, the problem is likely at the network layer—either with security group configuration, network ACLs, or routing. If the telnet/nc test succeeds but MySQL still times out, the issue may be with database-level configuration or authentication.
Sources
Troubleshooting connections to your MariaDB DB instance - Amazon Relational Database Service
Troubleshooting connections to your MySQL DB instance - Amazon Relational Database Service
Troubleshooting connection issues to your Amazon RDS DB instance - Amazon Relational Database Service

Most likely cause: The subnet is not configured as a "public subnet."

The "Publicly Accessible = Yes" setting merely determines whether a public DNS name or IP address is assigned to the RDS instance; it does not, on its own, guarantee external reachability. To ensure actual connectivity, the subnets where the RDS instances are deployed (at least two, given the Multi-AZ configuration) must be "public subnets" that have a route to an Internet Gateway.

Official AWS diagnostic tool: VPC Reachability Analyzer

This is precisely the "AWS-specific network diagnostic tool" referred to in your question. By simply specifying the source and destination, this tool automatically identifies which configuration element—such as a route table, security group (SG), or network ACL (NACL)—is causing the connectivity issue.