What do I do if I cannot or fail to connect to an ApsaraDB RDS instance that runs MySQL, PostgreSQL, SQL Server, or MariaDB? - ApsaraDB RDS

This topic describes how to resolve various issues that cause failures to connect to an ApsaraDB RDS instance.

Common connection errors

The following tables describe common connection errors for RDS instances that run different engines and the solutions to these errors.

Errors for RDS for MySQL or MariaDB

Error message	Cause	Solution
ERROR 2003 (HY000): Can't connect to MySQL server on 'XXX'(10038, 10060, or 110) Cannot connect to a database: XXX	Network communication is abnormal.	Make sure that the Elastic Compute Service (ECS) instance and the RDS instance reside in the same region. Make sure that the ECS instance and the RDS instance reside in the same type of network. Make sure that the ECS instance and the RDS instance reside in the same virtual private cloud (VPC). Make sure that the IP address of the ECS instance is added to an IP address whitelist of the RDS instance. For more information, see Solution.
ERROR 1045 (HY000): #28000ip not in whitelist ERROR 2801 (HY000): #RDS00ip not in whitelist, client ip is XXX ERROR 2013 (HY000): Lost connection to MySQL server at 'reading authorization packet', system error:110	The IP address whitelist of the RDS instance does not contain the IP address from which you want to connect to the RDS instance.	Check the IP address whitelist of the RDS instance
ERROR 1045 (28000): Access denied for user 'XXX'@'XXX' (using password: YES or NO) ERROR 1045 (28000): Authentication Failed For RDS maybe username or password is incorrect	The username or password is invalid.	Check the username and password that are used to establish a connection between instances
ERROR 2005 (HY000): Unknown MySQL server host 'XXX' (110 or 11004) SQLSTATE[HY000] [2002] php_network_getaddresses: getaddrinfo failed: Name or service not known Name or service not known unknown server host	The Domain Name System (DNS) server cannot resolve the endpoint of the RDS instance.	Check the endpoint of the RDS instance or modify the IP address of the DNS server
[Note] [MY-010914] [Server] Aborted connection 671541 to db: 'XXX' user: 'XXX' host: 'XXX' (The client was disconnected by the server because of inactivity.)	The connection to the RDS instance is closed.	The error occurs because the client does not send requests for a long period of time and the interaction timeout period of the server ends. If the RDS instance runs MySQL, `interactive_timeout` or `wait_timeout` is used to specify an interaction timeout period. Check the configuration of the RDS instance and adjust the timeout settings based on your business requirements. This prevents unexpected disconnections.

Errors for RDS for SQL Server

Error message	Cause	Solution
Cannot connect to XXX. A network-related or instance-specific error occurred while connecting to SQL Server. The server was not found or was inaccessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.) (Microsoft SQL Server, Error: 10060 or 258)	Network communication is abnormal.	Make sure that the ECS instance and the RDS instance reside in the same region. Make sure that the ECS instance and the RDS instance reside in the same type of network. Make sure that the ECS instance and the RDS instance reside in the same VPC. Make sure that the IP address of the ECS instance is added to an IP address whitelist of the RDS instance. Check whether the IP address and port number of the RDS instance are correctly configured for the ECS instance.
Cannot connect to XXX. A connection was successfully established with the server, but an error occurred during the logon process. (provider: TCP Provider, error: 0 - The network name that you specified can no longer be used.) (Microsoft SQL Server, Error: 64)	The IP address whitelist of the RDS instance does not contain the IP address from which you want to connect to the RDS instance.	Check the IP address whitelist of the RDS instance
Logon failed for login 'user' due to trigger execution	The number of connections to the RDS instance reaches the upper limit.	Check whether the number of connections to the RDS instance reaches the upper limit and whether blocked connections exist
cannot open user default database.Login failed	The default database for the user that is used to log on to the RDS for SQL Server instance does not have a linked user.	Create a linked user for the user that is used to log on to the default database.

Errors for RDS for PostgreSQL

Error message	Cause	Solution
Unable to connect to server: could not connect to server: Connection timed out (0x0000274C/10060)Is the server running on host "XXX.rds.aliyuncs.com" and acceptingTCP/IP connections on port XXX?	Network communication is abnormal.	Make sure that the IP address of the ECS instance is added to an IP address whitelist of the RDS instance. Check whether the configuration of the whitelist is correct. If you enable the enhanced whitelist mode, check whether the IP address whitelist is added to the required group. For more information, see Change the network isolation mode of an ApsaraDB RDS instance to the enhanced whitelist mode. For more information, see Solution.
server closed the connection unexpectedly This probably means the server terminated abnormally before or while processing the request. Error connecting to the server: FATAL: no pg_hba.conf entry	The IP address whitelist of the RDS instance does not contain the IP address from which you want to connect to the RDS instance.	Check the IP address whitelist of the RDS instance
FATAL: remaining connection slots are reserved for non-replication superuser connections	The number of connections to the RDS instance reaches the upper limit.	Stop the process for adding connections
FATAL: password authentication failed for user "xxx".	The password is invalid.	Reset the password and try again. For more information about how to reset a password, see Reset a password.

Issues that cause failures to connect to RDS instances by using DMS

You can see the following documentation to handle the errors that occur when you connect to RDS instances by using DMS: Use DMS to log on to an ApsaraDB RDS for MySQL instance, Use DMS to log on to an ApsaraDB RDS for SQL Server instance, Connect to an ApsaraDB RDS for PostgreSQL instance, and Connect to an ApsaraDB RDS for MariaDB instance.

Error message	Cause	Solution
The MYSQL server is running with the --rds-deny-access option so it cannot execute this statement	The RDS instance expires. The storage capacity of the RDS instance is exhausted.	Renew the RDS instance or upgrade the storage capacity of the RDS instance
You cannot use DMS to connect to the RDS instance.	You are not the owner of the RDS instance, and the owner of the RDS instance has not granted you the logon permissions.	Authorize your account to access the RDS instance. For more information, see Manage permissions.
Check whether the endpoint is valid, the IP address whitelists are correctly configured, and network communication is normal.	In most cases, this error occurs due to the following reasons when you connect a self-managed MySQL database that resides on an ECS instance or an on-premises host to the RDS instance: The firewall of the ECS instance or the firewall of the on-premises host does not allow access from the RDS instance. The security group to which the ECS instance belongs does not allow access from DMS. The self-managed MySQL database is not started. The self-managed MySQL database allows only the logons that you initiate from the ECS instance by using the credentials of the root account.	Check the firewall rules of the ECS instance or the on-premises host on which the self-managed MySQL database resides. Add the IP address of DMS servers to the security group of the ECS instance. Use the root account to log on to the MySQL database. For more information, see Solution.
max_user_connections	The number of connections to the RDS instance reaches the upper limit.	Solve the issue that the number connections to the RDS instance reaches the upper limit
Cannot log on to the RDS instance due to issues related to the IP address whitelist.	The CIDR blocks of the DMS servers are not added to an IP address whitelist of the RDS instance.	Add the CIDR block of the DMS servers to an IP address whitelist of the RDS instance

Issues that cause failures to connect an ECS instance to an RDS instance over an internal network

Before you connect an ECS instance to an ApsaraDB RDS instance by using the internal endpoint of the ApsaraDB RDS instance, you must add the private IP address of the ECS instance to an IP address whitelist of the ApsaraDB RDS instance.
Note
- For more information, see Configure an IP address whitelist for an RDS for MySQL instance, Configure an IP address whitelist for an RDS for SQL Server instance, Configure an IP address whitelist for an RDS for PostgreSQL instance, or Configure an IP address whitelist for an RDS for MariaDB instance.
- If you add the public IP address of the ECS instance to an IP address whitelist of the ApsaraDB RDS instance, you cannot connect the ECS instance to the ApsaraDB RDS instance by using the internal endpoint of the ApsaraDB RDS instance.
You can connect an ECS instance to an ApsaraDB RDS instance over an internal network only when these instances reside in the same region. These instances can reside in the same zone or different zones of the same region.
- Make sure that the ECS instance and the ApsaraDB RDS instance reside in the same region.
  1. View the region in which the ECS instance resides.
  2. View the region in which the ApsaraDB RDS instance resides.
- If the ECS instance and the ApsaraDB RDS instance reside in different regions, these instances cannot directly communicate with each other over an internal network. In this case, you can use one of the following methods to resolve the issue:
  - Method 1:
    - Release the ECS instance. Then, purchase an ECS instance that resides in the same region as the RDS instance.
    - Release the RDS instance. Then, purchase an RDS instance that resides in the same region as the ECS instance.
  - Method 2: Connect the ECS instance to the RDS instance by using the public endpoint of the RDS instance. For more information about how to apply for a public endpoint for an RDS instance, see Apply for or release a public endpoint for an RDS for MySQL instance, Apply for or release a public endpoint for an RDS for SQL Server instance, Apply for or release a public endpoint for an RDS for PostgreSQL instance, or Apply for or release a public endpoint for an RDS for MariaDB instance. This method cannot deliver optimal performance, security, or stability.

Check network types

Make sure that the ECS instance and the ApsaraDB RDS instance both reside in VPCs or in the classic network.
- View the network type of the ECS instance.
- View the network type of the RDS instance.
If one instance resides in the classic network and the other instance resides in a VPC, use one of the following methods to resolve the issue:
- Methods suitable in scenarios in which the ECS instance resides in a VPC and the RDS instance resides in the classic network:
  - Method 1: Change the network type of the RDS instance from the classic network to the VPC in which the ECS instance resides. This is the recommended method.
    Switch the network type.
  - Method 2: Purchase an ECS instance that resides in the classic network. Take note that a VPC provides higher security than the classic network. We recommend that you use VPCs.
    Note
    ECS instances cannot be migrated from VPCs to the classic network.
  - Method 3: Connect the ECS instance to the RDS instance by using the public endpoint of the RDS instance. For more information about how to apply for a public endpoint for an RDS instance, see Apply for or release a public endpoint for an RDS for MySQL instance, Apply for or release a public endpoint for an RDS for SQL Server instance, Apply for or release a public endpoint for an RDS for PostgreSQL instance, or Apply for or release a public endpoint for an RDS for MariaDB instance. This method cannot deliver optimal performance, security, or stability.
- Methods suitable in scenarios in which the ECS instance resides in the classic network and the RDS instance resides in a VPC:
  - Method 1 (recommended): Migrate the ECS instance from the classic network to the VPC in which the RDS instance to be connected resides. You can click View Connection Details on the right side of the Network Type page to view the ID of the VPC where the RDS instance resides. For more information, see Migrate an ECS instance.
  - Method 2: Change the network type of the RDS instance from a VPC to the classic network. Take note that a VPC provides higher security than the classic network. We recommend that you use VPCs.
  - Method 3: Use the ClassicLink feature to establish an internal network connection between the classic network-type ECS instance and the VPC-type RDS instance. For more information about the ClassicLink feature, see Enable ClassicLink.
    Note
    If the internal network connection between classic network-type ECS instance and the VPC-type RDS instance cannot be established after the ClassicLink feature is used, handle the issue based on the descriptions in Troubleshoot connection issues between a classic network and a VPC after you establish a ClassicLink connection.
  - Method 4: Connect the ECS instance to the RDS instance by using the public endpoint of the RDS instance. For more information about how to apply for a public endpoint for an RDS instance, see Apply for or release a public endpoint for an RDS for MySQL instance, Apply for or release a public endpoint for an RDS for SQL Server instance, Apply for or release a public endpoint for an RDS for PostgreSQL instance, or Apply for or release a public endpoint for an RDS for MariaDB instance. This method cannot deliver optimal performance, security, or stability.
If the ECS instance and the RDS instance both reside in VPCs, make sure that these instances reside in the same VPC.
- View the VPC ID of the ECS instance.
- View the network type of the RDS instance.
If the ECS instance and the RDS instance reside in different VPCs, use one of the following methods to resolve the issue:
- Method 1: This is the recommended method. Migrate the RDS instance to the VPC in which the ECS instance resides. For more information, see Change the VPC and vSwitch.
- Method 2: Create a Cloud Enterprise Network (CEN) instance to establish a connection between the two VPCs. For more information about CEN, see Use CEN to enable intra-region network communication.
- Method 3: Connect the ECS instance to the RDS instance by using the public endpoint of the RDS instance. For more information about how to apply for a public endpoint for an RDS instance, see Apply for or release a public endpoint for an RDS for MySQL instance, Apply for or release a public endpoint for an RDS for SQL Server instance, Apply for or release a public endpoint for an RDS for PostgreSQL instance, or Apply for or release a public endpoint for an RDS for MariaDB instance. This method cannot deliver optimal performance, security, or stability.
If the ECS instance and the RDS instance reside in the same VPC and in the same region, the ECS instance can connect to the RDS instance by using the public endpoint rather than the internal endpoint of the RDS instance, and both the ping and telnet commands return connection failures, you can resolve the issue based on the descriptions in What do I do if an ECS instance cannot connect to an ApsaraDB RDS instance due to routing problems?

Issues that cause failures to connect to an RDS instance over the Internet

Make sure that the public endpoint of the RDS instance is used to connect to the RDS instance. You can view the public endpoint of the RDS instance on the Database Connection page in the ApsaraDB RDS console.

Make sure that the public IP address of the on-premises device that you want to connect to the RDS instance is added to an IP address whitelist of the RDS instance. If the on-premises device can be connected to the RDS instance after 0.0.0.0/0 is added to the IP address whitelist of the RDS instance, the IP address that you added to the IP address whitelist is incorrect. In this case, obtain the correct public IP address of an on-premises device based on the following topics and then add the public IP address to an IP address whitelist of the RDS instance. For more information about how to configure an IP address whitelist for an RDS instance, see Configure a security group for an ApsaraDB RDS for MySQL instance, Configure a security group for an ApsaraDB RDS for SQL Server instance, Configure a security group for an ApsaraDB for PostgreSQL instance, or Configure an IP address whitelist for an ApsaraDB for MariaDB instance.

Note

A public IP address may change. After the public IP address is changed, you cannot use the original public IP address to establish a connection. To maintain a stable connection, we recommend that you use the internal endpoint of the RDS instance and add the internal IP address to the IP address whitelist of the RDS instance.

For more information, see the following documentation:

Reference

Troubleshooting methods for RDS connection failures

Application scope

ApsaraDB RDS