使用PHP从EC2通过VPC连接到RDS实例

Question

I've been looking on stackoverflow for quite some time, but I just can't seem to find a solution... Here's what my situation looks like:

• EC2 instance in us-east-1b (running CentOS 6)
• RDS instance in us-east-1b (multi-az is off)
• Both EC2 and RDS instances are in the same VPC
• Both EC2 and RDS instances use the same Security Group
• I can login into RDS from EC2 through the terminal
• I have my security group setup to allow ANY inbound IP address using TCP port 3306 (MySQL)
• It was a long shot, but I've also disabled SELINUX on EC2

Now here's my problem:

I can't seem to figure out how to connect to RDS from EC2 through a simple PHP script. Whenever I try to connect, I get error code 13. Since EC2 can connect through the terminal, I'm guessing that's due to being in the same subnet; however, when I try to connect through PHP (I'm assuming at this point it's trying to connect with the EIP address) I get an error.

Weird thing is a I can connect to RDS though Sequel Pro (Mac equivalent to Navicat or phpMyAdmin), but not through EC2.

I'm starting to think it's not longer a security group issue, but a OS/PHP configuration on my EC2 instance that's completely slipped my mind.

Any thoughts? Thanks in advanced!

Answer 1

I am re-posting my answer from another thread, since yours came up as related:

What are you running on your EC2? Just asking in case it's an SELinux (Security-Enhanced Linux), in which case it could possibly be the security limitation.

At your terminal, if you run:

getsebool -a | grep httpd

you should be able to see this limitation (whether your webserver can "network" or not. If it cannot, then run this, which should fix your problem:

setsebool -P httpd_can_network_connect 1

Hope that solves it, otherwise I don't see where the issue can arise, especially since you say you can connect via terminal (so AWS security groups should not be the issue).

Answer 2

You can try to connect to your RDS instance using your internal subnet IP address. To find out which one is you internal IP address (from your VPC subnet) from your EC2 instance in the same subnet:

ping <your-rds-endpoint-without-3306>

Double check you use the right credentials.