How to access AWS RDS Database instance with public access set to No?

Question

I am experimenting with this.
I have 2 VPCs.
A windows server instance with Azure data studio installed resides in VPC 1. 
A Postgres RDS database t3.micro is in a public subnet in VPC 2. It has been setup with public access set to No. Its security group allows the public IP of the EC2 instances in VPC 1.
A VPC Peering connection has been created between VPC 1 and VPC 2.

Whenever I try to connect to the RDS database instance, I get a timeout.
When I enable public access, it works like a charm.

How best can one achieve the connection to the RDS instance from Azure data studio on the EC2 Windows server instance?

Note: With AWS introducing charges for IPv4, one would not want the RDS instance network interface to get a public IPv4.

Steve Kinsman · Accepted Answer

Have you added entries to the subnet route tables to support traffic over the peering connection?  For both subnets you need to target the peering connection for traffic that has the other VPC as the destination.

Also although default NACLs will work fine, if you've got non-default rules in them then check they also allow for two-way traffic.

Riku_Kobayashi · Answer

Hello.

Add the EC2 security group to the inbound rules of the RDS security group.  
If VPCs in the same region are connected by peering, you can refer to the security group.  
If the VPCs are in different regions, you should be able to connect by setting the security group to allow the CIDR of the subnet where EC2 is running.  
https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html  
> The peer VPC can be a VPC in your account, or a VPC in another AWS account. To reference a security group in another AWS account, include the account number in Source or Destination field; for example, 123456789012/sg-1a2b3c4d.  
> You cannot reference the security group of a peer VPC that's in a different Region. Instead, use the CIDR block of the peer VPC.  
> To reference a security group in a peer VPC, the VPC peering connection must be in the active state.  
> If you configure routes to forward the traffic between two instances in different subnets through a middlebox appliance, you must ensure that the security groups for both instances allow traffic to flow between the instances. The security group for each instance must reference the private IP address of the other instance, or the CIDR range of the subnet that contains the other instance, as the source. If you reference the security group of the other instance as the source, this does not allow traffic to flow between the instances.

If you disable public access for RDS, RDS uses a private IP address to connect, so you will not be able to connect even if you allow public IP addresses in your security group.

How to access AWS RDS Database instance with public access set to No?

Relevant content