Unable to connect .NET 6-based AWS Lambda function to AWS RDS (MySql) database

Question

From Visual Studio, I am able to successfully use the 'Mock Lambda Test Tool' to connect and retrieve a simple data query from my AWS RDS MySql database.

However, once the lambda is published/uploaded to AWS, I am unable to successfully test using the Visual Studio publish test tool or from within AWS Lambda console. I get the following log - which seems to indicate that lambda times out after 30sec - from the Mock Lambda Test Tool, it typically returns after 3 seconds:

1/7/2023 11:27:33 PM    START RequestId: 9b681991-11db-4b12-b771-a346ce5f8b5b Version: $LATEST
1/7/2023 11:28:03 PM    2023-01-08T07:28:03.814Z 9b681991-11db-4b12-b771-a346ce5f8b5b Task timed out after 30.03 seconds
1/7/2023 11:28:03 PM    END RequestId: 9b681991-11db-4b12-b771-a346ce5f8b5b
1/7/2023 11:28:03 PM    REPORT RequestId: 9b681991-11db-4b12-b771-a346ce5f8b5b Duration: 30033.62 ms Billed Duration: 30000 ms Memory Size: 256 MB Max Memory Used: 90 MB Init Duration: 277.23 ms

I have added CloudWatch logging and it the lambda function appears to block on the conn.Open() call, presumably due to either permissions or VPC/security group issues, but I don't know how to localize this further.

I have the following permissions for my Lambda's execution role:

My Lambda and RDS share a common VPC, su.nets and security group. The following have been defined as Outbound rules for the security group - which I believe should be sufficient for the lambda to initiate a connection:

The following have been defined as Inbound rules:

I have very rudimentary code to retrieve test data - again, this works perfectly from the Mock Test Tool - At this point, I'm not even sure how I would go about localizing whether this is a permissions issue, VPC configuration issue or something else.

    try
    {
        // Connect to the database
        conn.Open();
        await WriteCloudWatchLogEvent("Connected to dB", DateTime.UtcNow);

        cmd = new MySqlCommand(cmdString, conn);
        MySqlDataReader rdr = cmd.ExecuteReader();
        var dataTable = new DataTable();
        dataTable.Load(rdr);

        for (int i=0; i < dataTable.Rows.Count; i++)
        {
           ... do something ...
        }
    }
    catch (Exception ex)
    {
        await WriteCloudWatchLogEvent("Catch exception="+ex.ToString(), DateTime.UtcNow);
    }
    conn.Close();

Answer 1

So it turns out that this issue was not related to roles/permissions or security group settings, but had to do with methods I called to create CloudWatch streams and then write to them. Once I replaced my custom CloudWatch logging system with LambdaLogger.Log(...), I was able to read from my RDS MySql instance.