A company has deployed an e-commerce web application in a new AWS account. An Amazon RDS for MySQL Multi-AZ DB instance is part of this deployment with a database-1.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com endpoint listening on port 3306. The company's Database Specialist is able to log in to MySQL and run queries from the bastion host using these details. When users try to utilize the application hosted in the AWS account, they are presented with a generic error message. The application servers are logging a `could not connect to server: Connection times out` error message to Amazon CloudWatch Logs. What is the cause of this error?
Show Answer & Explanation
Correct Answer: C. The security group assigned to the DB instance does not have the necessary rules to allow inbound connections from the application servers
Why C is correct: The security group assigned to the DB instance needs inbound rules allowing connections FROM the application servers. Security groups are stateful firewalls that control inbound and outbound traffic. Since the application servers are trying to connect TO the database on port 3306, the DB instance's security group must allow inbound traffic from the application servers' security group or IP addresses. The "Connection times out" error specifically indicates a network connectivity issue, not an authentication problem.Why other options are wrong: A & D: Authentication errors (incorrect credentials or authorization) would produce different error messages like "Access denied" or "Authentication failed," not "Connection times out" B: This is backwards - the application servers need outbound rules (which are typically allowed by default), not inbound rules. The application initiates the connection to the database, not vice versa.