How to add the ip of an instance in a vpc to the security group of rds ec2 classic instance with aws cli

Question

I describe my scenario which is not like the one described here Unable to add Ec2 VPC Security group in Non VPC RDS MySQL Security group? or here Adding Spot Instances to the Security Group of an RDS Instance : I have a fleet of spots in a ec2 vpc and I want to give you access to a rds data base that is in ec2 classic. Just like the second link, my spots are renewed from time to time and I have to be able to add the ip of the lawnched machine to the security group of the rds instance.

The configuration from the console is possible and works fine, just go to the security group of your rds instance and add a rule with a CIDR/IP.

But by doing so by cli with this command: aws rds authorize-db-security-group-ingress --db-security-group-name default --cidrip xxx.xx.x.xxx/32

I get this error: HTTPSConnectionPool(host='ec2.eu-west-1c.amazonaws.com', port=443): Max retries exceeded with url: / (Caused by NewConnectionError('<botocore.awsrequest.AWSHTTPSConnection object at 0x__________>: Failed to establish a new connection: Errno -2] Name or service not known',))

Details

• I created an IAM user with this Permissions boundary: AuthorizeDBSecurityGroupIngress

• Both spots vpc and rds ec2 classic instances are in the same eu-west-1c availability zone.

In the documentation of the command don't specify specifically that you can't do https://docs.aws.amazon.com/cli/latest/reference/rds/authorize-db-security-group-ingress.html . Also it would be strange that it can be done from the console and not from the cli.

I don't know what I'm missing, any ideas?

Answer 1

There's another way of using Security Groups, instead of using an IP, you use a security group ID.

For example:

You create a new security group, let's call it "MySpecialSG". Don't add any rules to this SG.

Then create a new SG, let's call it "Allow my Other SG". Now you will add an inbound rule, but instead of using IPs, you will use "MySpecialSG" group ID and the port you need.

This last SG is the one that you will assign to your DB instance.

Answer 2

I've finally solved the problem. The solution was that I was not adding the IAM user credentials with the access policy necessary to perform that action.

To use aws cli through the user-data of the instance you have to export the credentials of that IAM user as environment variables.

Info:

• Policies for the classic link
• Credentials export