Guides

How to Create an Amazon RDS MySQL Database and Connect from EC2

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

To create an Amazon RDS for MySQL database and connect from EC2, first make a security group for the database that allows MySQL/Aurora (TCP 3306) only from the EC2 instance's security group. Then in RDS → Create database choose MySQL, the Free tier or Dev/Test template, Public access: No, the same VPC and that security group. On the Amazon Linux 2023 instance install the client with sudo dnf install mariadb105 -y and connect with mysql -h <RDS-ENDPOINT> -u admin -p.

sudo dnf install mariadb105 -y
mysql --version
mysql -h appdb.abcdefgh1234.ap-south-1.rds.amazonaws.com -u admin -p
# mysql> SHOW DATABASES;

What do I need before creating an RDS database?

• An Amazon Linux 2023 EC2 instance with a security group, for example web-sg. See How to Launch an EC2 Instance in AWS and How to SSH into EC2.
• The EC2 instance and the database in the same region and VPC (the default VPC is fine for learning).
• A cost check: RDS charges per hour while the instance exists, unless your account's free tier covers it. Delete it after the lab, and set up a billing alarm and budget first.

How does EC2 reach the RDS database?

How do I create an RDS MySQL database and connect from EC2?

Step 1 — Create the database security group

EC2 → Security Groups → Create security group → name db-sg, same VPC → Inbound rules → Add rule:

Using a security group as the source means "any instance that has web-sg" — it keeps working when the EC2 IP changes, and nothing else in the world can reach 3306.

Step 2 — Start creating the database

RDS → Databases → Create database → Full configuration (older consoles and the AWS docs call it Standard create; don't pick Easy create or express configuration) → engine MySQL → keep the default current MySQL 8.x version → template Free tier if your account shows it, otherwise Dev/Test with Single-AZ.

Step 3 — Name, credentials and size

Step 4 — Connectivity: keep it private

Open Additional configuration → Initial database name appdb → keep automated backups on → Create database. Wait until Status shows Available (usually several minutes), open the database and copy the Endpoint from Connectivity & security.

The console option Connect to an EC2 compute resource can create a matching pair of security groups for you automatically. It is fine too; this guide does it by hand so you understand the rule.

Step 5 — Install the MySQL client on the EC2 instance

SSH into the instance and install only the client (no database server is needed on EC2):

sudo dnf install mariadb105 -y
mysql --version                     # mysql  Ver 15.1 Distrib 10.5...-MariaDB

Step 6 — Connect to RDS

mysql -h appdb.abcdefgh1234.ap-south-1.rds.amazonaws.com -u admin -p

Type the master password when asked (nothing appears while typing). You are in when you see the MySQL [(none)]> prompt:

SHOW DATABASES;
SELECT VERSION();

For an encrypted connection, download the RDS certificate bundle and use it:

curl -o global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
mysql -h <RDS-ENDPOINT> -u admin -p --ssl-ca=global-bundle.pem --ssl-verify-server-cert

Step 7 — Create an application user (never use admin in the app)

CREATE DATABASE IF NOT EXISTS appdb;
CREATE USER 'app_user'@'%' IDENTIFIED BY 'Use-A-Long-Random-Password!';
GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'app_user'@'%';
SHOW GRANTS FOR 'app_user'@'%';
EXIT;

'%' means "from any host" at the MySQL level. That is acceptable here only because db-sg already allows nobody except web-sg. Your app now uses the endpoint, app_user and appdb. 🗄️

Step 8 — Clean up after the lab

RDS → select appdb → Actions → Delete → decide about the final snapshot (a snapshot is kept, and billed, until you delete it) → type delete me → Delete. If you ticked deletion protection, turn it off first with Modify.

How do I fix common RDS connection errors?

Ghabru naka 😅 — these are the usual ones: