AWS Private Link between VPCs

Question

I set up Private link between Ohio ec2 instance and Virgina RDS mysql database and this is my current situation:

I can access Virginia RDS database from Ohio ec2 instance if I bypass RDS Proxy, I mark RDS IP directly in Network Load Balancer Target Group.
However I can not access Virginia RDS from Ohio ec2 instance when I try to use RDS Proxy, I mark RDS Proxy IP addresses in Network Load Balance Target Group.

Also, when I try to access VA RDS database from VA ec2 instance it works fine. I can access it directly, through RDS Proxy DNS, or through Network Load Balancer DNS.

Even when I allow all traffic in my security group in every point of Private Link, I still face the issue. Anyone has any idea what could be wrong?

Steven · Accepted Answer

### Summary

Direct RDS works but RDS Proxy doesn't because RDS Proxy enforces TLS/certificate (SNI) validation and its IPs are dynamic — not because of security groups. Don't front RDS Proxy with an NLB by IP; use the VPC Resource Gateway pattern instead.

---------------------

### Details

**Why direct RDS works but RDS Proxy doesn't (through cross-region PrivateLink)**

Great troubleshooting on your side — the fact that direct RDS works but RDS Proxy fails through the exact same NLB/PrivateLink path is the key clue. It tells us the problem is not your security groups or PrivateLink config (those are fine), but rather how RDS Proxy itself handles connections.

**The likely root cause**

1. TLS / hostname (SNI) validation

RDS Proxy enforces TLS and validates that the hostname you connect to matches its certificate (*.proxy-oooo..rds.amazonaws.com).
   - A direct RDS endpoint is more permissive, so reaching it by IP through an NLB still works.
   - With RDS Proxy, when you connect via the NLB DNS name or a hardcoded proxy IP, the name the client presents doesn't match the proxy's certificate, so the TLS handshake is rejected — before security groups even matter. That's exactly why opening all traffic in every SG makes no difference: the network path is open, but the connection is refused at the TLS layer.

2. RDS Proxy IPs are not static

The backend IP addresses behind RDS Proxy can change over time. Hardcoding them as NLB targets is fragile — when an IP rotates, that target goes unhealthy and connections drop. This is why fronting RDS Proxy with an NLB by IP is not a supported/stable pattern.

This also explains why everything works from your Virginia EC2 — there you connect to the proper RDS Proxy DNS endpoint within the same region, so TLS/SNI validation passes. The failure only appears in the "cross-region + NLB-by-IP" combination.

**Recommended solution**

Instead of fronting RDS / RDS Proxy with an NLB and registering IPs, use the purpose-built VPC Resource Gateways (VPC Lattice resource configurations). AWS designed this specifically for accessing resources like RDS privately and securely across VPCs and regions, and it handles the IP-rotation and TLS concerns for you.

---------------------

### Resource
[1] See Use case: Accessing RDS resources privately and securely in: https://aws.amazon.com/blogs/networking-and-content-delivery/vpc-resource-gateways-implementation-patterns-and-use-cases/

Florian Turnwald · Answer

See VPC resource gateways - Use case 1: Accessing RDS resources privately and securely -> https://aws.amazon.com/blogs/networking-and-content-delivery/vpc-resource-gateways-implementation-patterns-and-use-cases/
That is you need to use here.

re:Post Agent · Answer

Based on your setup, the issue you're experiencing with RDS Proxy access through AWS PrivateLink appears to be related to how RDS Proxy handles connections rather than a security group or PrivateLink configuration problem.

Here are the most likely causes and things to verify:

**RDS Proxy Connection Behavior:**
RDS Proxy uses connection pooling and maintains persistent connections to your RDS database. When you're routing through a Network Load Balancer to RDS Proxy IP addresses across regions, the proxy may be having issues with:

1. **Connection pinning** - RDS Proxy pins connections based on certain session variables or transaction states. Cross-region NLB routing might be interfering with this behavior.

2. **Health checks** - Verify that your NLB health checks are properly configured for RDS Proxy endpoints. RDS Proxy has specific requirements for health check configurations that differ from direct RDS connections.

3. **Target registration** - When you register RDS Proxy IP addresses as targets, ensure you're using all the IP addresses associated with the proxy endpoint across all Availability Zones in the Virginia region.

**Things to check:**

- Verify the RDS Proxy endpoint is accessible within its own VPC by testing from your Virginia EC2 instance (which you've confirmed works)
- Check NLB target health status when RDS Proxy IPs are registered - they may be showing as unhealthy
- Review RDS Proxy CloudWatch metrics for connection errors or failed connection attempts from the Ohio region
- Ensure your RDS Proxy has the correct IAM authentication settings if you're using IAM database authentication
- Verify that the security group attached to your RDS Proxy allows inbound traffic from the NLB's private IP addresses

Since direct RDS access works through your PrivateLink setup but RDS Proxy doesn't, this confirms your cross-region PrivateLink configuration is functioning correctly. The issue is specifically with how RDS Proxy is handling the proxied connections through the NLB.

Consider reviewing your RDS Proxy logs and NLB access logs to identify where the connection is failing in the chain.  
**Sources**  
[Using AWS Private Link for application integration | AWS re:Post](https://repost.aws/articles/ARiQEmBqydTQCtOWm7J_rKGw/using-aws-private-link-for-application-integration)  
[AWS PrivateLink extends cross-region connectivity to AWS services | Networking & Content Delivery](https://aws.amazon.com/blogs/networking-and-content-delivery/aws-privatelink-extends-cross-region-connectivity-to-aws-services/)

AWS Private Link between VPCs

Summary

Details

Resource

Add your answer

Relevant content