求助：Ansible mysql_db模块从EC2连接AWS RDS时仍尝试本地连接

我需要通过Ansible的mysql_db模块从EC2实例连接AWS RDS并删除指定数据库（不使用rds模块）。目前EC2可以直接登录RDS，但执行Ansible任务时，明明指定了RDS主机地址，错误却显示尝试连接localhost。

我的Ansible任务代码 #

- name: Delete database with name 'testdb' in RDS
  mysql_db:
    login_host: "xxxxxxx.us-east-1.rds.amazonaws.com"
    login_password: "{{ mysql_user_password }}"
    login_user: "{{ mysql_user }}"
    login_port: 3306
    name: "{{ db_name }}"
    state: absent

报错详情 #

TASK [mysql57rds : Delete database with name 'testdb' in RDS] ********************************************************************************************************************************************************************************
task path: /mnt/c/ansible/testdb-ansible/roles/mysql57rds/tasks/main.yml:35

fatal: [10.0.x.x]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "ca_cert": null,
            "check_hostname": null,
            "check_implicit_admin": false,
            "client_cert": null,
            "client_key": null,
            "collation": "",
            "config_file": "/root/.my.cnf",
            "config_overrides_defaults": false,
            "connect_timeout": 30,
            "dump_extra_args": null,
            "encoding": "",
            "force": false,
            "hex_blob": false,
            "ignore_tables": [],
            "login_host": "xxxxxxxx.rds.amazonaws.com",
            "login_password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "login_port": 3306,
            "login_unix_socket": null,
            "login_user": "admin",
            "master_data": 0,
            "name": [
                "testdb"
            ],
            "quick": true,
            "restrict_config_file": false,
            "single_transaction": false,
            "skip_lock_tables": false,
            "state": "absent",
            "target": null,
            "unsafe_login_password": false,
            "use_shell": false
        }
    },
    "msg": "unable to connect to database, check login_user and login_password are correct or /root/.my.cnf has the credentials. Exception message: (1045, \"Access denied for user 'admin'@'localhost' (using password: YES)\")"
}

解决方案 #

• 强制忽略本地配置文件：错误提示中提到/root/.my.cnf，该文件的配置会覆盖任务中指定的参数。如果文件内配置了host=localhost，模块会优先使用这个配置。在任务中添加restrict_config_file: yes参数，强制模块只使用你指定的连接参数：

  - name: Delete database with name 'testdb' in RDS
    mysql_db:
      login_host: "xxxxxxx.us-east-1.rds.amazonaws.com"
      login_password: "{{ mysql_user_password }}"
      login_user: "{{ mysql_user }}"
      login_port: 3306
      name: "{{ db_name }}"
      state: absent
      restrict_config_file: yes
  

• 验证RDS用户的连接权限：确保RDS的admin用户允许从EC2实例的IP地址连接。可以通过RDS控制台或SQL语句检查用户权限：

  SELECT user, host FROM mysql.user WHERE user = 'admin';
  

  如果结果中没有EC2实例的IP或%（允许所有地址），需要更新用户权限：

  GRANT ALL PRIVILEGES ON testdb.* TO 'admin'@'<EC2实例IP>' IDENTIFIED BY '你的密码';
  FLUSH PRIVILEGES;
  

• 修正任务参数的引号格式：原任务中使用了转义的\"，可能导致参数解析异常，直接使用正常双引号或去掉变量的引号即可（如login_user: {{ mysql_user }}）。

内容的提问来源于stack exchange，提问作者Nitesh Singhal