# Cannot connect to RDS with appropriate policies

**URL:** <https://forum.serverless.com/t/cannot-connect-to-rds-with-appropriate-policies/1594>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [March 30, 2017, 4:28pm UTC](https://forum.serverless.com/t/cannot-connect-to-rds-with-appropriate-policies/1594 "2017-03-30T16:28:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stevenmwade](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/stevenmwade/32/1545_2.png) [@stevenmwade](https://forum.serverless.com/u/stevenmwade)\
**Post date:** [March 30, 2017, 4:28pm UTC](https://forum.serverless.com/t/cannot-connect-to-rds-with-appropriate-policies/1594/1 "2017-03-30T16:28:15Z")

</div>

I cannot connect to my RDS instance when running the function, but can when running it locally. Here is my `yaml` file which is in the same VPC as the instance. I ended up manually adding the AmazonRDSFullAccess policy and still no no avail.

```auto
service: wholesale-logging

provider:
  name: aws
  runtime: nodejs4.3
  stage: dev
  profile: lab
  vpc:
    securityGroupIds:
      - sg-NNNNNNNN
      - sg-NNNNNNNN
    subnetIds:
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
      - subnet-NNNNNNNN
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "rds:*"
      Resource: "*"
functions:
  create:
    handler: functions/logger/log.create
    events:
      - http:
          path: log
          method: post

```

and the function code:

```auto
'use strict';
const Massive = require('massive');
const db = Massive.connectSync({connectionString: 'postgres://delorean:back-to-the-future@wholesale-logging.cclyw00l55b3.us-east-1.rds.amazonaws.com:5432/logging'})

module.exports.create = (event, context, callback) => {
  db.app.find({}, (err, apps) => {
    console.log(apps)

    const response = {
      statusCode: 200,
      body: {
        data: 'test'
      }
    };

    callback(null, response);
  });
};

```

---

<div class="post-metadata">

**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\
**Post date:** [March 30, 2017, 9:22pm UTC](https://forum.serverless.com/t/cannot-connect-to-rds-with-appropriate-policies/1594/2 "2017-03-30T21:22:33Z")

</div>

It’s most likely that it’s _not_ an IAM policy issue - it’s much more likely to be a networking issue.

It looks like you’ve all the right pieces of config from a `serverless.yml` point of view, but I can’t see the RDS networking configuration.

The things to check (in order):

1. Subnets: of your functions and database.
2. Routing table: confirm that your function subnet can route to your database subnet.
3. NACLs: if you have them (hopefully you don’t).
4. Security groups: remember to check both inbound and outbound (aka. ingress/egress) on both sides of the equation.

If you have [VPC Flow Logs](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/flow-logs.html) enabled, look for the IP (and port 5432 for `pgsql`) of the ENI your functions are using to see if the connection is being attempted. If you don’t have flow logs, turn them on!

Hope that helps.

---

<div class="post-metadata">

**Author:** ![stevenmwade](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/stevenmwade/32/1545_2.png) [@stevenmwade](https://forum.serverless.com/u/stevenmwade)\
**Post date:** [March 31, 2017, 1:50pm UTC](https://forum.serverless.com/t/cannot-connect-to-rds-with-appropriate-policies/1594/3 "2017-03-31T13:50:03Z")

</div>

1. I took the subnets and security group IDs straight from the RDS instance, so they are exactly the same. We use these to stand up every test, so these have connected before, just not when made with Serverless 1.x

2. They are on the same subnets

3. All in the same NACL which allows all traffic (our cloud team set these up)

4. Inbound and outbound are set correctly

All in all, we have used these before on other projects and it work except for this one.