<h3>Objective</h3>
<p>My objective is to to connect to an RDS (Postgres) database from a pod running in an AWS EKS cluster. I am using Terraform for provisioning but not necessarily looking for Terraform code solution.</p>
<h2>What I have tried</h2>
<p>I have created the database (trimmed down settings like password, username...etc.) like:</p>
<pre class="lang-sh prettyprint-override"><code>resource &quot;aws_db_instance&quot; &quot;rds-service&quot; {
  name                  = &quot;serviceDB&quot;
  engine                = &quot;postgres&quot;
  db_subnet_group_name  = aws_db_subnet_group.service_subnet_group.name
  }
</code></pre>
<p>Then created a security group to allow traffic</p>
<pre class="lang-sh prettyprint-override"><code>resource &quot;aws_security_group&quot; &quot;db&quot; {
  name   = &quot;service-rds-access&quot;
  vpc_id = module.vpc.vpc_id

  ingress {
    description = &quot;Postgres from VPC&quot;
    from_port   = 5432
    to_port     = 5432
    protocol    = &quot;tcp&quot;
    cidr_blocks = [&quot;0.0.0.0/0&quot;]
  }
}
</code></pre>
<p>Which uses  a subnet group that I have created (<em><strong>Note that RDS is only deployed on private subnets, and I used the same subnets which are a subset of the subnets that I have used to deploy my service on EKS</strong></em>)</p>
<pre class="lang-sh prettyprint-override"><code>resource &quot;aws_db_subnet_group&quot; &quot;service_subnet_group&quot; {
  name       = &quot;service-subnet-group&quot;
  subnet_ids = [module.vpc.subnet_a_private_id, module.vpc.subnet_b_private_id]
}
</code></pre>
<h2>What does not work</h2>
<p>Upon attempting to connect from the Pod, I can't reach the RDS. I have also tried getting a shell into the pod and attempting to manually connect to the RDS Instance like:</p>
<p>Running <code>psql --version</code> I got: <code>psql (PostgreSQL) 11.9</code>, and then when I tried to authenticate via <code>psql</code> like:</p>
<pre class="lang-sh prettyprint-override"><code>psql --host=$HOST_NAME --port=5432 --username=$USER_NAME --password --dbname=postgres
</code></pre>
<p>I got (edits are mine):</p>
<pre class="lang-sh prettyprint-override"><code>psql: could not connect to server: Connection timed out
    Is the server running on host &quot;&lt;hostname&gt;.amazonaws.com&quot; &lt;IP&gt; and accepting
    TCP/IP connections on port 5432?
</code></pre>

alt-f4
<p>You can use following options to find root-cause;</p>
<ol>
<li>Use <a href="https://aws.amazon.com/blogs/aws/new-vpc-insights-analyzes-reachability-and-visibility-in-vpcs/" rel="nofollow noreferrer">VPC Reachability Analyzer</a> : Create and analyze path with Source type Network Interfaces and Source as Network Interface Id of the ec2/node where you pods are deployed. Furthermore, select Destination type as Network Interfaces and Destination as network Interface Id of the RDS DB instance. Put Destination port as 5432, keep Protocol as TCP. Then execute the path analysis. In case you have multiple ec2/nodes for pods, I assume these ec2/nodes have same setup.</li>
</ol>
<p>Note*: It takes few minutes for completion of this path analysis.</p>
<p>OR</p>
<ol start="2">
<li>If you have enabled <strong>VPC Flow Logs</strong>, then you can trace vpc flow logs to check, which aws resource is rejecting the network traffic. For VPC flow logs information please refer <a href="https://aws.amazon.com/blogs/aws/vpc-flow-logs-log-and-view-network-traffic-flows/" rel="nofollow noreferrer">this</a> document from AWS.</li>
</ol>
<p>Furthermore, Check VPC flow logs of AWS lambda's network interface(s) of EC2 of pods and RDS DB instance.</p>
