asp.net-mvc – 在EC2实例上运行的MVC应用程序无法访问RDS数据库

问题

I am unable to connect to my Amazon RDS database instance.

你的问题：

When attempting to connect from an EC2 instance that is not in a VPC,
the DB instance’s security group is not configured to allow access by
the EC2 instance.

解：

如果尝试从EC2经典实例进行连接失败,请从数据库实例安全组授予用户访问权限.有关更多信息,请查看以下内容：

如果要从Amazon EC2实例访问数据库实例,则必须首先确定您的EC2实例和数据库实例是否在VPC中.如果您使用的是默认VPC,则可以在创建或修改EC2实例将访问的数据库实例时分配用于EC2实例的相同EC2或VPC安全组.

如果您的数据库实例和EC2实例不在VPC中,则必须使用允许来自Amazon EC2实例的流量的入口规则配置数据库实例的安全组.您可以通过将EC2实例的Amazon EC2安全组添加到数据库实例的数据库安全组来完成此操作.在此示例中,您将入口规则添加到Amazon EC2安全组的数据库安全组.

重要

Adding an ingress rule to a DB security group for an Amazon EC2
security group only grants access to your DB instances from Amazon EC2
instances associated with that Amazon EC2 security group.

You can’t authorize an Amazon EC2 security group that is in a
different AWS region than your DB instance. You can authorize an IP
range,or specify an Amazon EC2 security group in the same region that
refers to IP address in another region. If you specify an IP range,we
recommend that you use the private IP address of your Amazon EC2
instance,which provides a more direct network route from your Amazon
EC2 instance to your Amazon RDS DB instance,and does not incur
network charges for data sent outside of the Amazon network.

AWS管理控制台

将EC2安全组添加到数据库安全组

>登录AWS管理控制台并在https://console.aws.amazon.com/rds/打开Amazon RDS控制台.
>从控制台窗口左侧的导航窗格中选择安全组.
>选择要授予访问权限的数据库安全组的详细信息图标.

>在安全组的详细信息页面中,选择,从“连接类型”下拉列表中选择“EC2安全组”,然后选择要使用的Amazon EC2安全组.然后单击“授权”.

>入口规则的状态将是授权,直到新入口规则应用于与您修改的数据库安全组关联的所有数据库实例.成功应用入口规则后,状态将更改为已授权.

CLI

要授予对Amazon EC2安全组的访问权限,请使用AWS CLI命令authorize-db-security-group-ingress.

例

对于Linux,OS X或Unix：

aws rds authorize-db-security-group-ingress 
    --db-security-group-name default  
    --ec2-security-group-name myec2group 
    --ec2-security-group-owner-id 987654321021

对于Windows：

aws rds authorize-db-security-group-ingress ^
    --db-security-group-name default  ^
    --ec2-security-group-name myec2group ^
    --ec2-security-group-owner-id 987654321021

该命令应生成类似于以下内容的输出：

SECGROUP  Name     Description 
SECGROUP  default  default
      EC2-SECGROUP  myec2group  987654321021  authorizing

API

要授权对Amazon EC2安全组进行网络访问,请使用以下参数调用该Amazon RDS API函数http://docs.aws.amazon.com//AmazonRDS/latest/APIReference/API_AuthorizeDBSecurityGroupIngress.htmlAuthorizeDBSecurityGroupIngress：

EC2Security-GroupName = myec2group

EC2SecurityGroupOwnerId = 987654321021

例

https://rds.amazonaws.com/
    ?Action=AuthorizeDBSecurityGroupIngress
    &EC2SecurityGroupOwnerId=987654321021
    &EC2Security-GroupName=myec2group
    &Version=2009-10-16
    &SignatureVersion=2
    &SignatureMethod=HmacSHA256
    &Timestamp=2009-10-22T17%3A10%3A50.274Z
    &AWSAccessKeyId=<AWS Access Key ID>
    &Signature=<Signature>

资源链接：

> How do I resolve problems connecting to my Amazon RDS database
instance?
> Authorizing Network Access to a DB Instance from an Amazon EC2 Instance