- Newest
- Most votes
- Most comments
You're correct that you cannot associate a security group from one VPC with an RDS instance in another VPC. The error message you're receiving is accurate - RDS instances can only use security groups that belong to the same VPC where the RDS instance is being created.
Security groups are VPC-specific resources, and while you mentioned that one security group is "associated with" another VPC, security groups cannot actually span across VPCs. Each security group exists within exactly one VPC and can only be attached to resources within that same VPC.
In your case, since you're creating the RDS instance in vpc-0b080b222222, you can only use security groups that belong to vpc-0b080b222222 (like sg-047fed222222). You cannot use sg-0b2c61111111 because it belongs to vpc-00c0ea111111.
If you need to allow traffic between resources in different VPCs, you would need to set up VPC peering, Transit Gateway, or another connectivity solution, and then configure the security groups within each VPC appropriately.
Sources
Control traffic to your AWS resources using security groups - Amazon Virtual Private Cloud
DBSecurityGroup - Amazon Relational Database Service
There is a also a new feature - VPC Security Group sharing - that came out recently that lets you share the security group to accounts in an AWS organisation. I have not tried this myself, but I think it fits your usecase.
https://docs.aws.amazon.com/vpc/latest/userguide/security-group-sharing.html
Relevant content
- asked 2 years ago
- asked 2 years ago
Sharing the VPC Security Group to other accounts is, also, something RDS does not support.
I get:
I can't: