title: Access Private RDS DB From Another VPC
body: <p>I'm trying to access a private RDS Instance from a different VPC using a Peering Connection. I have two VPCs:</p>
  
  <ol>
  <li>VPC-K8S (<code>172.20.0.0/16</code>) with one public subnet</li>
  <li>VPC-RDS (<code>172.17.0.0/16</code>) with one public subnet (<code>172.17.0.0/24</code>) and 3 private subnets (<code>172.17.{1,2,3}.0/24</code>)</li>
  </ol>
  
  <p>VPC-RDS has 2 security groups (not actual names):</p>
  
  <ol>
  <li><code>default</code>, which accepts SSH from my IP</li>
  <li><code>db</code>, which accepts TCP over port 5432 from the <code>default</code> security group.</li>
  </ol>
  
  <p>I deploy my DB instances in VPC-RDS after creating a DB Subnet Group in the private subnets, and configure it to not be publicly accessible. To access it from my workstation, I create a small instance in the public subnet of VPC-RDS with the <code>default</code> security group, and create an SSH tunnel:</p>
  
  <pre><code>ssh -L 5432:rds-host-name.us-east-1.rds.amazonaws.com:5432  -i "KeyName.pem"  ec2-user@ec2-host-name.compute-1.amazonaws.com
  </code></pre>
  
  <p>I can access the RDS from my workstation via localhost.</p>
  
  <p>I want to be able to access my RDS instance from my Kubernetes cluster (VPC-K8S). I set up a peering connection between the two, and configure the route tables appropriately (in VPC-K8S: <code>172.17.0.0/16 -&gt; pcx-112233</code>; VPC-RDS: <code>172.20.0.0/16 -&gt; pcx-112233</code>)</p>
  
  <p>I cannot connect to RDS from one of my K8S nodes, or any instance in the K8S VPC. I suspected that it had something to do with the <code>db</code> security group, but even when I opened port 5432 to all IPs (0.0.0.0/0) it didn't help. </p>
  
  <p>Any ideas how to do this, or is this only possible via a publicly accessible RDS instance or a Bastion host that is in VPC-RDS and the <code>default</code> SG?</p>