问题已经得到解答，但我想补充一下，如果您要连接到 RDS 的公共 DNS（例如 prod.upd9999upd.us-east-1.rds.amazonaws.com），那么您必须启用对私有 IP 的 DNS 解析。这是通过AllowDnsResolutionFromRemoteVpc 完成的。
示例：将 Vpc EC2_PROD(172.0.0.0/16) 连接到 Vpc RDS_PROD(30.0.0.0/16)。
1) 创建从 EC2 VPC（请求者）到 RDS VPC（接受者）的Peering connection。
通过右键单击已创建的对等连接和“编辑 DNS 设置”，确保使用 UI 启用AllowDnsResolutionFromRemoteVpc。或following command
aws ec2 modify-vpc-peering-connection-options --vpc-peering-connection-id "pcx-04a511409bb08ef16" --requester-peering-connection-options '{"AllowDnsResolutionFromRemoteVpc":true}' --accepter-peering-connection-options '{"AllowDnsResolutionFromRemoteVpc":true}' --region us-east-1
您的最终对等连接将如下所示：
aws ec2 describe-vpc-peering-connections --profile aws-work --region us-east-1
{
"VpcPeeringConnections": [
{
"Status": {
"Message": "Active",
"Code": "active"
},
"Tags": [
{
"Value": "ec2-to-rds-peering-connection",
"Key": "Name"
}
],
"AccepterVpcInfo": {
"PeeringOptions": {
"AllowEgressFromLocalVpcToRemoteClassicLink": false,
"AllowDnsResolutionFromRemoteVpc": true,
"AllowEgressFromLocalClassicLinkToRemoteVpc": false
},
"VpcId": "vpc-RDS",
"Region": "us-east-1",
"OwnerId": "?",
"CidrBlockSet": [
{
"CidrBlock": "30.0.0.0/16"
}
],
"CidrBlock": "30.0.0.0/16"
},
"VpcPeeringConnectionId": "pcx-04a511409bb08ef16",
"RequesterVpcInfo": {
"PeeringOptions": {
"AllowEgressFromLocalVpcToRemoteClassicLink": false,
"AllowDnsResolutionFromRemoteVpc": true,
"AllowEgressFromLocalClassicLinkToRemoteVpc": false
},
"VpcId": "vpc-ec2",
"Region": "us-east-1",
"OwnerId": "?",
"CidrBlockSet": [
{
"CidrBlock": "172.0.0.0/16"
}
],
"CidrBlock": "172.0.0.0/16"
}
}
]
}
2) 您的Requester VPC (Ec2 VPC) 路由表必须添加Accepter IP cider（例如30.0.0.0/16）。 （参见下面的Routes 标签）
aws ec2 describe-route-tables --filters Name=tag:Name,Values=EC2_PROD --profile aws-work --region us-east-1
{
"RouteTables": [
{
"Associations": [
{
"RouteTableAssociationId": "rtbassoc-?",
"Main": true,
"RouteTableId": "rtb-?"
}
],
"RouteTableId": "rtb-?",
"VpcId": "vpc-EC2_PROD",
"PropagatingVgws": [],
"Tags": [
{
"Value": "EC2_PROD",
"Key": "Name"
}
],
"Routes": [
{
"GatewayId": "local",
"DestinationCidrBlock": "172.0.0.0/16",
"State": "active",
"Origin": "CreateRouteTable"
},
{
"Origin": "CreateRoute",
"DestinationCidrBlock": "30.0.0.0/16", // Accepter IP cider block
"State": "active",
"VpcPeeringConnectionId": "pcx-04a511409bb08ef16"
},
{
"GatewayId": "igw-???",
"DestinationCidrBlock": "0.0.0.0/0",
"State": "active",
"Origin": "CreateRoute"
}
]
}
]
}
3) 同样Acceptor VPC (RDS VPC) 路由表必须添加Requester IP cider（例如172.0.0.0/16）。 （参见下面的Routes 标签）
aws ec2 describe-route-tables --filters Name=tag:Name,Values=RDS_PROD --profile aws-work --region us-east-1
{
"RouteTables": [
{
"Associations": [
{
"SubnetId": "subnet-?",
"RouteTableAssociationId": "rtbassoc-?",
"Main": false,
"RouteTableId": "rtb-?"
}
],
"RouteTableId": "rtb-?",
"VpcId": "vpc-RDS",
"PropagatingVgws": [],
"Tags": [
{
"Value": "RDS_PROD",
"Key": "Name"
}
],
"Routes": [
{
"Origin": "CreateRoute",
"DestinationCidrBlock": "172.0.0.0/16", // Requester IP cider block
"State": "active",
"VpcPeeringConnectionId": "pcx-04a511409bb08ef16"
},
{
"GatewayId": "local",
"DestinationCidrBlock": "30.0.0.0/16",
"State": "active",
"Origin": "CreateRouteTable"
},
{
"GatewayId": "igw-???",
"DestinationCidrBlock": "0.0.0.0/0",
"State": "active",
"Origin": "CreateRoute"
}
]
}
]
}
4) 最后还更新 Accepter VPC(RDS) 上的防火墙/安全组，以允许从 Ec2 VPC 的 3306 端口（如果它的 mysql）连接。
aws ec2 describe-security-groups --filters Name=tag:Name,Values=RDS_FIREWALL --profile aws-work --region us-east-1
{
"SecurityGroups": [
{
"IpPermissionsEgress": [
{
"IpProtocol": "-1",
"PrefixListIds": [],
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"UserIdGroupPairs": [],
"Ipv6Ranges": []
}
],
"Description": "Dev",
"Tags": [
{
"Value": "RDS_FIREWALL",
"Key": "Name"
}
],
"IpPermissions": [
{
"PrefixListIds": [],
"FromPort": 3306,
"IpRanges": [
{
"Description": "EC2_VPC_IP_CIDER",
"CidrIp": "172.0.0.0/16"
}
],
"ToPort": 3306,
"IpProtocol": "tcp",
"UserIdGroupPairs": [],
"Ipv6Ranges": []
}
],
"GroupName": "RDS_FIREWALL",
"VpcId": "vpc-???",
"OwnerId": "???",
"GroupId": "sg-???"
}
]
}