如何用C#连接AWS上的MySQL并有效验证连接状态？

为什么错误凭证未触发报错？ #

AWS SDK for .NET的客户端对象采用懒加载机制：创建AmazonSimpleSystemsManagementClient实例仅完成本地配置初始化，不会发起任何网络请求到AWS服务。只有调用实际的AWS API操作（如查询参数、发送命令）时，才会携带凭证发起请求，此时才会验证凭证有效性。

有效的AWS连接验证方法 #

修改代码，在创建客户端后调用一个简单的SSM API操作，触发凭证验证。例如调用DescribeParameters（需确保IAM用户拥有ssm:DescribeParameters权限）：

try
{
    var ssmClient = AwsConnection.ConnectToAWSByVariables(
        accessKeyId: "xxx",
        secretAccessKey: "wrongwrong",
        regionString: "xxx"
    );
    
    // 调用实际API触发凭证验证
    var response = await ssmClient.DescribeParametersAsync(new DescribeParametersRequest());
    Console.WriteLine("Successfully connected to AWS using environment variables.");
}
catch (AmazonServiceException ex)
{
    // 捕获AWS服务异常，比如凭证错误、权限不足
    Console.WriteLine($"AWS Service Error: {ex.Message}");
}
catch (Exception ex)
{
    Console.WriteLine($"Error: {ex.Message}");
}

实现类似AWS CLI的测试流程（SSM会话+MySQL查询） #

要模拟CLI的ssm start-session + MySQL查询流程，可使用SSM的SendCommand API（适合非交互式执行远程命令），直接在目标实例上执行MySQL连接与查询命令。以下是完整实现：

1. 核心代码实现 #

using Amazon.SimpleSystemsManagement;
using Amazon.SimpleSystemsManagement.Model;
using System.Collections.Generic;
using System.Threading.Tasks;

public static class AwsSsmMysqlTest
{
    public static async Task RunSsmMysqlTest()
    {
        var ssmClient = AwsConnection.ConnectToAWSByVariables(
            accessKeyId: "your-access-key",
            secretAccessKey: "your-secret-key",
            regionString: "your-region"
        );

        try
        {
            // 发送SSM命令到目标基站主机
            var sendCommandRequest = new SendCommandRequest
            {
                InstanceIds = new List<string> { "your-instance-id" }, // 替换为目标实例ID
                DocumentName = "AWS-RunShellScript",
                Parameters = new Dictionary<string, List<string>>
                {
                    {
                        "commands", new List<string>
                        {
                            // 执行MySQL连接与查询命令（替换为你的实际参数）
                            @"mysql -h xxx.rds.amazonaws.com -u xxx -p'your-mysql-password' -e ""SELECT 1 AS ConnectionTest;"""
                        }
                    }
                }
            };

            var sendCommandResponse = await ssmClient.SendCommandAsync(sendCommandRequest);
            string commandId = sendCommandResponse.Command.CommandId;
            Console.WriteLine($"SSM command sent successfully. Command ID: {commandId}");

            // 轮询获取命令执行结果
            await WaitForCommandCompletion(ssmClient, commandId, "your-instance-id");
        }
        catch (AmazonServiceException ex)
        {
            Console.WriteLine($"AWS Service Error: {ex.Message}");
        }
        catch (Exception ex)
        {
            Console.WriteLine($"Error: {ex.Message}");
        }
    }

    private static async Task WaitForCommandCompletion(IAmazonSimpleSystemsManagement ssmClient, string commandId, string instanceId)
    {
        while (true)
        {
            var request = new GetCommandInvocationRequest
            {
                CommandId = commandId,
                InstanceId = instanceId
            };

            var response = await ssmClient.GetCommandInvocationAsync(request);
            if (response.Status == CommandStatus.Success)
            {
                Console.WriteLine("Command executed successfully. Output:");
                Console.WriteLine(response.StandardOutputContent);
                break;
            }
            else if (response.Status == CommandStatus.Failed || response.Status == CommandStatus.Cancelled)
            {
                Console.WriteLine($"Command failed. Error: {response.StandardErrorContent}");
                break;
            }

            // 等待5秒后重试
            await Task.Delay(5000);
            Console.WriteLine("Waiting for command completion...");
        }
    }
}

// 原有的连接方法保持不变
public static class AwsConnection
{
    public static IAmazonSimpleSystemsManagement ConnectToAWSByVariables(
        string accessKeyId,
        string secretAccessKey,
        string regionString)
    {
        var awsCredentials = new Amazon.Runtime.BasicAWSCredentials(accessKeyId, secretAccessKey);
        var region = Amazon.RegionEndpoint.GetBySystemName(regionString);
        return new AmazonSimpleSystemsManagementClient(awsCredentials, region);
    }
}

2. 关键注意事项 #

• 权限配置：确保IAM用户拥有ssm:SendCommand、ssm:GetCommandInvocation权限；目标实例的IAM角色需绑定AmazonSSMManagedInstanceCore权限，且已安装SSM Agent。
• 密码安全：避免硬编码MySQL密码，建议使用AWS Secrets Manager或SSM Parameter Store存储密码，在命令中通过aws ssm get-parameter动态获取。
• 网络配置：目标实例需能访问RDS实例（安全组、网络ACL需开放对应端口与IP范围）。

内容的提问来源于stack exchange，提问作者Mike