"ip not in whitelist" error when connecting to an RDS instance from an ECS instance over an internal network

Problem description

When you connect to an RDS instance, one of the following error messages is returned:

• ERROR 1045 (HY000): #28000ip not in whitelist

• ERROR 2801 (HY000): #RDS00ip not in whitelist, client ip is XXX

Solutions

To resolve the issue, check the following items:

• The whitelist contains only the default IP address 127.0.0.1. This IP address prevents any device from accessing the RDS instance. Add the IP address of the device to the whitelist. For more information, see Set a whitelist.

• The whitelist is set to 0.0.0.0. The correct format is 0.0.0.0/0.

  Note

  This IP address allows any device to access the RDS instance. Use this IP address with caution.

• If enhanced whitelist mode is enabled, perform the following checks:

  • If you use the internal endpoint of a virtual private cloud (VPC), ensure that the internal IP address of the ECS instance is added to the VPC group.

  • If you use the internal endpoint of a classic network, ensure that the internal IP address of the ECS instance is added to the classic network group.

  • If you connect over the public network, ensure that the public IP address of the device is added to the classic network group. VPC groups do not apply to public network connections.

• The public IP address that you added to the whitelist may not be the device's actual egress IP address. This can occur for the following reasons:

  • The public IP address is dynamic and can change.

  • The public IP address returned by an IP address lookup tool or website is inaccurate.

    Note

    To obtain the public IP address of your device, see the following articles.

    • How to find the local IP address for SQL Server

    • How to find the local IP address for RDS for MySQL or MariaDB

    • How to find the local IP address for an RDS for PostgreSQL instance

• If you add the IP address of an ECS instance or a local server to the database whitelist but still receive the "ip not in whitelist" error, the connection may be routed through a proxy server. In this case, the IP address that reaches the database is the IP address of the proxy server. Add the egress IP address of the ECS instance or the egress IP address of the proxy server for your local server to the whitelist.

Applicable to

• RDS for MySQL

• RDS for SQL Server

• RDS for PostgreSQL