使用CDK配置AWS Aurora VPC集群公开访问后仍连接超时如何解决

核心原因 #

你当前配置的Aurora Serverless v1集群默认部署在VPC私有子网，且未开启公网访问属性，即使安全组放通了端口，公网流量也无法到达集群，这是连接超时的最常见诱因。

修复步骤 #

• 调整集群部署配置，将集群放置在VPC公有子网，同时开启publiclyAccessible属性，允许集群分配公网IP
• 确认VPC公有子网路由表已绑定互联网网关（IGW），CDK默认创建的VPC会自动完成该配置，无需额外修改
• 调整客户端连接超时阈值，集群触发自动暂停后首次冷启动需要10-30秒，过短的超时时间会触发连接报错

修改后完整CDK代码 #

import { CdkWorkshopStack } from "../stacks/cdk-workshop-stack";
import * as rds from "@aws-cdk/aws-rds";
import * as ec2 from "@aws-cdk/aws-ec2";
import { ServerlessCluster } from "@aws-cdk/aws-rds";
import { Duration } from "@aws-cdk/core";

export const createDbInstance = (
  scope: CdkWorkshopStack
): { cluster: ServerlessCluster; dbName: string } => {
  // Create the VPC needed for the Aurora Serverless DB cluster
  const vpc = new ec2.Vpc(scope, "AuroraVPC");

  const dbName = "yt_backup";
  // Create the Serverless Aurora DB cluster; set the engine to Postgres
  const cluster = new rds.ServerlessCluster(scope, "yt_backup_cluster", {
    engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,
    parameterGroup: rds.ParameterGroup.fromParameterGroupName(
      scope,
      "ParameterGroup",
      "default.aurora-postgresql10"
    ),
    // 新增：开启公网访问
    publiclyAccessible: true,
    // 新增：指定集群部署在公有子网
    vpcSubnets: {
      subnetType: ec2.SubnetType.PUBLIC
    },
    defaultDatabaseName: dbName,
    //@ts-ignore
    vpc: vpc,
    //@ts-ignore
    scaling: { autoPause: Duration.minutes(10) },
  });
  cluster.connections.allowDefaultPortFromAnyIpv4();

  return { cluster, dbName };
};

验证步骤 #

部署完成后登录AWS RDS控制台，查看集群详情中的端点信息，确认存在公网地址后再使用对应端点、端口5432、Secrets Manager中存储的主账号用户名密码进行连接。

内容的提问来源于stack exchange，提问作者Shivam