AWS Lambda inside VPC cannot connect to RDS MySQL (timeout)

Question

Background

I'm building a Lambda function (Node.js 20 runtime) that connects to an Amazon RDS MySQL database within the same VPC.

Both the Lambda and the RDS instance are deployed in private subnets.
However, every attempt to connect results in a connection timeout.

What I’ve tried

Verified that the Lambda is in the same VPC and private subnets as the RDS instance.
Allowed inbound traffic on port 3306 from the Lambda's security group to the RDS security group.
Added a NAT Gateway to the subnets used by the Lambda (no change).
Tested connectivity from an EC2 instance in the same subnet — connection succeeds.

Code sample

import mysql from "mysql2/promise";

export const handler = async () => {
  const conn = await mysql.createConnection({
    host: process.env.DB_HOST,
    user: "admin",
    password: process.env.DB_PASS,
  });
  const [rows] = await conn.query("SELECT 1");
  console.log(rows);
};

Question

What could cause a Lambda function inside a VPC to time out when connecting to an RDS instance in the same VPC, even though security groups and subnets seem properly configured?

"Allowed inbound traffic on port 3306 from the Lambda's security group to the RDS security group." That is a rule you created inside the RDS instance's security group, correct? The way you phrased it makes that unclear. Creating that rule in the Lambda function's security group would not have any effect. — Mark B
– Mark B, Commented Oct 29 at 15:32
To isolate the issue, temporarily allow all inbound traffic to the RDS instance (in its associated security group) and test whether you could connect. If you could, then the issue is with security groups. — LoMaPh
– LoMaPh, Commented Oct 30 at 7:32
Use the EC2 instance with the lambda's security group only to see if the connection still goes through. I am suspecting the lambda's security group might be causing the issue, maybe outbound traffic rules? you can also perform a ping (ICMP) from the lambda function to see if the destination is reachable - allow for ICMP inbound traffic on the RDS instance. — atish.s
– atish.s, Commented Nov 10 at 15:30

John Rotenstein · Accepted Answer · 2025-11-03 20:02:38Z

-1

The configuration should be:

A security group on the AWS Lambda function (Lambda-SG) that permits all outbound traffic to 0.0.0.0/0
A security group on the RDS database (RDS-SG) that permits inbound on port 3306 traffic from RDS-SG

That is, RDS-SG should specifically reference Lambda-SG.

Also, make sure the Network ACLs (NACLs) are set to their default 'Allow All' configuration and both the Lambda function and the RDS database are in the same VPC.

answered Nov 3 at 20:02

John Rotenstein

273k28 gold badges455 silver badges540 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

AWS Lambda inside VPC cannot connect to RDS MySQL (timeout)

Background

What I’ve tried

Code sample

Question

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

Background

What I’ve tried

Code sample

Question

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related