ApsaraDB RDS:What do I do if I fail to connect to an ApsaraDB RDS instance?

Network errors

These errors indicate that the client cannot reach the RDS instance over the network.

DNS resolution errors

These errors appear when the client cannot resolve the RDS endpoint to an IP address.

Error messages (MySQL / MariaDB):

• ERROR 2005 (HY000): Unknown MySQL server host 'XXX' (110 or 11004)

• SQLSTATE[HY000] [2002] php_network_getaddresses: getaddrinfo failed: Name or service not known

• Name or service not known

• unknown server host

Fix:

1. Check that the endpoint is correct. Common mistakes:

   • Typos in the endpoint. RDS endpoints follow the format rm-xxx.xxx.rds.aliyuncs.com.

   • The public endpoint was manually released and is no longer active.

   • The endpoint is truncated by the application because it exceeds the application's maximum string length.

2. If the endpoint is correct but the error persists, update your DNS server address to Alibaba Cloud's DNS server based on your connection type:

   Connection type	DNS server addresses
   Classic network	10.143.22.116 or 10.143.22.118
   VPC	100.100.2.136 or 100.100.2.138
   Internet	223.5.5.5 or 223.6.6.6

IP address whitelist errors

These errors mean your client's IP address is blocked by the RDS instance whitelist.

Error messages (MySQL / MariaDB):

• ERROR 1045 (HY000): #28000ip not in whitelist

• ERROR 2801 (HY000): #RDS00ip not in whitelist, client ip is XXX

• ERROR 2013 (HY000): Lost connection to MySQL server at 'reading authorization packet', system error: 110

Error message (SQL Server):

• Cannot connect to XXX. A connection was successfully established with the server, but an error occurred during the logon process... (Microsoft SQL Server, Error: 64)

Error messages (PostgreSQL):

• server closed the connection unexpectedly This probably means the server terminated abnormally before or while processing the request.

• Error connecting to the server: FATAL: no pg_hba.conf entry

Error message (DMS):

• Cannot log on to the RDS instance due to issues related to the IP address whitelist.

Fix: Check and update the IP address whitelist for your engine:

• MySQL: Configure an IP address whitelist

• SQL Server: Configure an IP address whitelist

• PostgreSQL: Configure an IP address whitelist

• MariaDB: Configure an IP address whitelist

For a detailed walkthrough, see Check the IP address whitelist of the RDS instance.

For DMS whitelist issues, see Add the CIDR block of the DMS server to an IP address whitelist.

Authentication errors

These errors indicate that the username or password is incorrect.

Error messages (MySQL / MariaDB):

• ERROR 1045 (28000): Access denied for user 'XXX'@'XXX' (using password: YES or NO)

• ERROR 1045 (28000): Authentication Failed For RDS maybe username or password is incorrect

• Access denied for user 'root'@'XXX' (using password: YES) to database 'XX'

Error message (PostgreSQL):

• FATAL: password authentication failed for user "xxx".

Fix:

• Verify the username and password in your connection string.

• ApsaraDB RDS does not provide root accounts. If you need an account, create a dedicated one—see Create an account.

• If the password contains special characters, enclose it in single quotation marks. For example: -p 'your_password'.

• To reset a forgotten password, go to the Accounts page of your RDS instance in the ApsaraDB RDS console and change the password there.

  A new password takes effect a few minutes after you change it. If you use Data Management (DMS), log in to DMS again with the new password.

• For PostgreSQL, see Reset a password.

`root` account access denied (MySQL):

By default, MySQL allows root account logins only from localhost. Remote root logins are denied. Create a dedicated account with the minimum required permissions:

-- Create an account that can connect only from the ECS instance IP address
CREATE USER '<user_name>'@'<172.16.XX.XX>' IDENTIFIED BY '<password>';

-- Grant only the permissions needed, following the principle of least privilege (PoLP)
GRANT SELECT, INSERT, UPDATE, DELETE ON <database_name>.* TO '<user_name>'@'<172.16.XX.XX>';
FLUSH PRIVILEGES;

Authentication plug-in errors (MySQL 8.0)

Error message:

• ERROR 2059 (HY000): Authentication plugin 'caching_sha2_password' cannot be loaded: /usr/xx/xx/caching_sha2_password.so: cannot open shared object file: No such file or directory

Cause: MySQL 8.0 uses caching_sha2_password by default, but the plug-in may be missing depending on the system or installation method.

Fix:

• Client running MySQL 8.0 (plug-in missing): Use one of these methods:

  • Method 1: Switch the account to use mysql_native_password. ``sql ALTER USER 'your_username'@'localhost' IDENTIFIED WITH mysql_native_password BY 'your_password'; FLUSH PRIVILEGES; ``

  • Method 2: Reinstall MySQL to restore the plug-in. ``bash sudo yum reinstall mysql-server ``

• Client running MySQL 5.x: The client version does not support caching_sha2_password. Install MySQL 8.0.

  sudo yum install mysql-server

Connection limit errors

These errors occur when the RDS instance has reached its maximum number of connections.

Error messages:

• FATAL: remaining connection slots are reserved for non-replication superuser connections (PostgreSQL)

• Logon failed for login 'user' due to trigger execution (SQL Server)

• max_user_connections (DMS)

Fix:

• PostgreSQL: Stop the process adding connections

• SQL Server: Check whether connections reach the upper limit and whether blocked connections exist

• DMS: Resolve the issue of reaching the connection limit

Connection timeout (MySQL)

Error message:

• [Note] [MY-010914] [Server] Aborted connection 671541 to db: 'XXX' user: 'XXX' host: 'XXX' (The client was disconnected by the server because of inactivity.)

Cause: The client was idle long enough for the server's interaction timeout to expire. MySQL uses interactive_timeout or wait_timeout to specify an interaction timeout period.

Fix: Adjust the timeout parameters in your RDS instance configuration to match your application's idle behavior.

Instance locked errors (DMS)

Error message:

• The MYSQL server is running with the --rds-deny-access option so it cannot execute this statement

Cause: The RDS instance is locked due to expiration or exhausted storage capacity.

Fix: Log in to the ApsaraDB RDS console and check whether the instance is locked:

• If locked due to expiration: Renew the instance.

• If locked due to insufficient storage: Expand the storage capacity.

"Destination Host Unreachable" error

Error message:

• From XXX (172.17.XX.XX) icmp_seq=1 Destination Host Unreachable

Cause: The internal CIDR block of the RDS instance conflicts with the CIDR block of another service, such as an ECS instance.

Fix: See What do I do if I am unable to connect to an ApsaraDB RDS instance and the "Destination Host Unreachable" error message is displayed?

If the instances are in different regions

You cannot connect them over an internal network. Use one of these approaches:

• Option 1 (preferred): Move the instances to the same region by releasing and repurchasing one of them.

  • Release an ECS instance

  • Release an RDS instance

• Option 2: Connect over the Internet using the RDS public endpoint. This delivers lower performance, security, and stability than an internal connection.

Check network types

Both instances must use the same network type—either VPC or classic network.

If ECS is in a VPC and RDS is in the classic network:

• Option 1 (preferred): Migrate the RDS instance to the VPC. See Change the network type.

• Option 2: Purchase a new ECS instance in the classic network. Note that a VPC provides higher security than the classic network.

  ECS instances cannot be migrated from VPCs to the classic network.

• Option 3: Use the public endpoint of the RDS instance. This delivers lower performance, security, and stability.

If ECS is in the classic network and RDS is in a VPC:

• Option 1 (preferred): Migrate the ECS instance to the VPC. To find the VPC ID, click View Details next to Network Type for the RDS instance. See Migrate an ECS instance.

• Option 2: Change the RDS network type to classic network. Note that a VPC provides higher security than the classic network.

• Option 3: Use the ClassicLink feature to connect the classic network-type ECS instance to the VPC-based RDS instance over an internal network. See Enable ClassicLink.

  If the connection still fails after enabling ClassicLink, see Troubleshoot connection issues after establishing a ClassicLink connection.

• Option 4: Use the public endpoint. This delivers lower performance, security, and stability.

If both instances are in VPCs but different VPCs

• Option 1 (preferred): Migrate the RDS instance to the ECS instance's VPC. See Change the VPC and vSwitch.

• Option 2: Create a Cloud Enterprise Network (CEN) instance to connect the two VPCs. See Use CEN to enable intra-region network communication.

• Option 3: Use the public endpoint. This delivers lower performance, security, and stability.

If both instances are in the same VPC and region but the connection still fails

If the public endpoint works but both ping and telnet fail on the internal endpoint, there may be a routing problem. See What do I do if an ECS instance cannot connect to an RDS instance due to routing problems?