Connect to Your Database

Here's how traffic will flow from your application server to your database:

1. Application server initiates connection
   • Your server needs an outbound rule allowing traffic to the database.
   • Port: 5432 (PostgreSQL default port)
   • If your server has a default outbound rule allowing all traffic, you won't need to add a specific rule here.
2. Traffic routes through VPC
   • VPCs allow internal communication between subnets by default.
   • Your patientping-public-a subnet can reach your patientping-private-a subnet automatically.
3. Database accepts connection
   • Your RDS instance needs an inbound rule allowing traffic from your application servers.
   • Port: 5432
   • Source: The security group of your application servers
   • Inbound connections, unlike outbound, must be managed carefully and only via specific rules.

Configure security groups so your application server can reach the RDS instance on port 5432.

1. Configure the app server security group – this is likely already done.
   1. Navigate to "EC2" → "Security Groups" (under "Network & Security") in the AWS Console.
   2. Find your application server security group (patientping-public) and select it.
   3. Go to the "Outbound rules" tab.
   4. Ensure that there's a single IPV4 outbound rule allowing all traffic for all protocols on all ports to all destinations (0.0.0.0/0).
2. Confirm the RDS DB's security group – this is likely already done.
   1. Navigate to "Aurora and RDS" → "Databases" in the AWS Console.
   2. Select your database (patientping-db).
   3. In the "Connectivity & security" tab, scroll down to "Security group rules" and confirm that all existing rules are associated with patientping-rds-sg.
3. Add the necessary inbound rule to allow the app server to access the DB instance.
   1. Navigate back to "EC2" → "Security Groups" in the AWS Console.
   2. Select the RDS DB's security group (patientping-rds-sg).
   3. Go to the "Inbound rules" tab and click "Edit inbound rules."
   4. Click "Add rule" and use the following settings:
      • Type: PostgreSQL (will auto-select TCP port 5432)
      • Source: Custom
      • Source (search bar): Find and select the application server SG (patientping-public)
   5. Click "Save rules."
   6. Take a moment to review the rules in the RDS security group. You probably have a default inbound rule allowing access from your own computer's IP address, and a default outbound rule allowing all traffic. This is fine; just make sure the new rule allowing access from the app server SG is also present.
4. Test the connection between your EC2 instance and your RDS database.
   1. SSH into your EC2 instance: ssh patientping
   2. Update the system: sudo dnf upgrade
   3. Install the PostgreSQL client: sudo dnf install postgresql17
   4. Verify that psql is in your PATH: which psql
   5. Test the connection to your RDS instance using psql. Get your endpoint from the RDS database's page → "Connectivity & security" tab → "Endpoints":

      psql -h patientping-db.XXXXX.us-east-1.rds.amazonaws.com -U postgres -d patientping
      

   6. Enter the password you set during database creation.
   7. If successful, you should see a PostgreSQL prompt like patientping=> which means you're in!
   8. Type \q to quit the psql prompt and return to the shell in your SSH session.

Run and submit the CLI tests.

For AWS CLI users, here's the syntax to configure security group rules:

# Add outbound rule to app server security group (assuming you want a specific rule)
aws ec2 authorize-security-group-egress --group-id APP-SG-ID --ip-permissions IpProtocol=tcp,FromPort=5432,ToPort=5432,UserIdGroupPairs=[{GroupId=RDS-SG-ID}]

# Add inbound rule to DB security group
aws ec2 authorize-security-group-ingress --group-id RDS-SG-ID --ip-permissions IpProtocol=tcp,FromPort=5432,ToPort=5432,UserIdGroupPairs=[{GroupId=APP-SG-ID}]