RDS Connectivity Timeout¶

1. Summary¶

The application on Elastic Beanstalk times out while connecting to or querying Amazon RDS, causing request latency, 5xx errors, or failed startup. This is confusing because the symptom often appears in application logs only, while the root cause may be SG rules, subnet routing, DNS, credential drift, or exhausted database connections.

flowchart TD
    A[RDS connectivity timeout] --> B{Why DB access fails}
    B --> C[SG or network path blocked]
    B --> D[Wrong endpoint, DNS, or port]
    B --> E[DB overloaded or connection budget exhausted]
    B --> F[Credentials or TLS settings changed]
    C --> G[Inspect SGs routes and subnet path]
    D --> H[Inspect endpoint port and DNS resolution]
    E --> I[Inspect app pool behavior and DB load]
    F --> J[Inspect auth and SSL error patterns]
    G --> K[Validate hypotheses]
    H --> K
    I --> K
    J --> K

Limitations

• DB-side metrics and logs may not be fully available from the EB host alone.
• This playbook targets reachability and connection establishment, not query optimization.
• Timeouts and authentication failures can be interleaved; read logs carefully.

Quick Conclusion

• First determine whether the timeout is network, endpoint, connection-pool, or auth-related.
• Compare one application timeout with the exact DB endpoint, port, and SG path in use.

2. Common Misreadings¶

• "Database timeout means the database is down." App pool exhaustion or SG drift can look the same.
• "The endpoint is correct because it has not changed." Failover, rotation, or env var drift can still matter.
• "Security groups are broad enough." Wrong source SG or subnet path still blocks access.
• "A connect timeout and auth error are the same class." They imply different mechanisms.
• "If one app instance connects, all should connect." Subnet/AZ or node-local config can differ.

3. Competing Hypotheses¶

4. What to Check First¶

1. Pull application logs around the timeout.

eb logs --environment-name $ENV_NAME --all
sudo less /var/log/web.stdout.log

1. Confirm environment variables or connection settings.

aws elasticbeanstalk describe-configuration-settings \
    --application-name $APP_NAME \
    --environment-name $ENV_NAME

1. Review SG and subnet path between EB and RDS.

aws ec2 describe-security-groups --group-ids $INSTANCE_SECURITY_GROUP_ID $RDS_SECURITY_GROUP_ID
aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=$SUBNET_ID_1,$SUBNET_ID_2

1. Inspect the RDS instance endpoint and port.

aws rds describe-db-instances --db-instance-identifier $DB_INSTANCE_IDENTIFIER

5. Evidence to Collect¶

Required Evidence¶

• App logs with exact timeout error text.
• Current DB endpoint, port, and security group references.
• EB instance SG and RDS SG rules.
• Connection-pool or retry behavior from the app if available.

Useful Context¶

• Recent DB failover, rotation, credential, or certificate changes.
• RDS engine type and whether proxying is in use.
• Whether the issue affects startup only or all runtime queries.

CLI Investigation Commands¶

aws elasticbeanstalk describe-configuration-settings \
    --application-name $APP_NAME \
    --environment-name $ENV_NAME
aws rds describe-db-instances --db-instance-identifier $DB_INSTANCE_IDENTIFIER
aws ec2 describe-security-groups --group-ids $INSTANCE_SECURITY_GROUP_ID $RDS_SECURITY_GROUP_ID
aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=$SUBNET_ID_1,$SUBNET_ID_2

CloudWatch Logs Insights Queries¶

fields @timestamp, @message
| filter @message like /timeout|could not connect|Connection timed out|ECONNREFUSED|ENOTFOUND|SSL/
| sort @timestamp asc
| limit 100

6. Validation and Disproof by Hypothesis¶

H1. SG or network path blocks DB access¶

Evidence that SUPPORTS¶

Evidence that DISPROVES¶

Validation Commands¶

aws ec2 describe-security-groups --group-ids $INSTANCE_SECURITY_GROUP_ID $RDS_SECURITY_GROUP_ID
aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=$SUBNET_ID_1,$SUBNET_ID_2

Normal vs Abnormal¶

H2. Wrong DB endpoint, DNS, or port¶

Evidence that SUPPORTS¶

Evidence that DISPROVES¶

Validation Commands¶

aws elasticbeanstalk describe-configuration-settings \
    --application-name $APP_NAME \
    --environment-name $ENV_NAME
aws rds describe-db-instances --db-instance-identifier $DB_INSTANCE_IDENTIFIER

Normal vs Abnormal¶

H3. DB load or connection budget exhaustion¶

Evidence that SUPPORTS¶

Evidence that DISPROVES¶

Validation Commands¶

sudo less /var/log/web.stdout.log
aws cloudwatch get-metric-statistics --namespace AWS/ApplicationELB --metric-name RequestCount --dimensions Name=LoadBalancer,Value=$LOAD_BALANCER_DIMENSION --statistics Sum --period 60 --start-time $START_TIME --end-time $END_TIME

Normal vs Abnormal¶

H4. Credentials or TLS settings changed¶

Evidence that SUPPORTS¶

Evidence that DISPROVES¶

Validation Commands¶

sudo less /var/log/web.stdout.log
aws elasticbeanstalk describe-configuration-settings \
    --application-name $APP_NAME \
    --environment-name $ENV_NAME

Normal vs Abnormal¶

7. Likely Root Cause Patterns¶

8. Immediate Mitigations¶

1. Restore the minimal required SG path from EB instances to the RDS security group.

2. If environment variables drifted, update them with the correct endpoint or credentials.

aws elasticbeanstalk update-environment \
    --environment-name $ENV_NAME \
    --option-settings Namespace=aws:elasticbeanstalk:application:environment,OptionName=DB_HOST,Value=$DB_HOST

1. Reduce app concurrency or expensive DB traffic if the DB connection budget is exhausted.

2. Roll back the recent credential/TLS change if that is the clear trigger and policy allows it.

9. Prevention¶

1. Reference DB endpoints and secrets from controlled configuration, not ad hoc edits.
2. Use SG-to-SG rules rather than broad CIDR assumptions.
3. Track connection-pool wait and DB connection saturation as first-class metrics.
4. Test failover, secret rotation, and TLS changes in staging.
5. Keep health endpoints from depending on heavy DB calls unless necessary.

See Also¶

• VPC Connectivity Issues
• High Latency Under Load
• Load Balancer Returns 5xx Errors

Sources¶

• https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.managing.vpc.html
• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html
• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ConnectToPostgreSQLInstance.html
• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_CommonTasks.Connect.EndpointAndPort.html