PHP新手对接AWS RDS遇SQLSTATE[HY000] [2002]连接拒绝问题求助

Hey there, let’s work through that frustrating connection error you’re hitting when trying to link your php-login-minimal script to AWS RDS. I’ve dealt with this exact issue a few times, so here’s a step-by-step breakdown of the most common fixes:

1. Ensure Your RDS Instance is Publicly Accessible #

First up, check if your RDS instance allows external connections:

• Log into the AWS Console, navigate to your RDS instance, and go to the Connectivity & security tab.
• Look for the "Public accessibility" setting—this needs to be set to Yes. If it’s No, your PHP server (whether it’s on EC2 or an external host) can’t reach the instance over the internet.
• Note: You don’t need to restart the instance after changing this, but give it a minute or two to take effect.

2. Update Your RDS Security Group Rules #

Security groups are often the culprit here. Let’s make sure traffic can flow to your RDS instance:

• From the Connectivity & security tab, click on your instance’s "VPC security groups" to open the group details.
• Go to the Inbound rules section and add a new rule:
  • Type: MySQL/Aurora
  • Protocol: TCP
  • Port range: 3306 (default MySQL port—adjust if you changed it during RDS setup)
  • Source: Enter the public IP address of your PHP server (for production) or temporarily use 0.0.0.0/0 (only for testing—never leave this in production, it’s a huge security risk).
• Confirm the security group is actually attached to your RDS instance (it’s easy to accidentally select the wrong group during setup).

3. Double-Check Your DB Credentials & Endpoint #

Typos or incorrect details are super common—let’s verify:

• DBHOST: Make sure you copied the full RDS endpoint correctly (no extra spaces, missing characters, or typos). Grab it directly from the AWS Console’s "Connectivity & security" tab to avoid mistakes.
• DBUSER & DBPASS: Confirm these match the master username/password you set when creating the RDS instance, or a dedicated user that has permissions to access the login database.
• DBNAME: Ensure the login database actually exists on your RDS instance. You can connect with a MySQL client (like Workbench) to check this.

4. Test Network Connectivity From Your PHP Server #

Let’s confirm your server can reach the RDS endpoint:

• SSH into your PHP server and run one of these commands:

  telnet instancename.cfci0i1rm4rl.us-east-2.rds.amazonaws.com 3306
  

  or

  nc -zv instancename.cfci0i1rm4rl.us-east-2.rds.amazonaws.com 3306
  

• If the connection fails, it means there’s a network block: either your RDS security group isn’t allowing traffic, your PHP server has an outbound firewall (like iptables) blocking port 3306, or the RDS instance isn’t publicly accessible.

5. Confirm the MySQL Port is Correct #

If you changed the default MySQL port (3306) when setting up your RDS instance, you need to add it to your PDO connection string:
Modify your connection line to include the port:

$db = new PDO("mysql:host=".DBHOST.";port=YOUR_CUSTOM_PORT;charset=utf8mb4;dbname=".DBNAME, DBUSER, DBPASS);

Quick Note on Error Handling #

You’re already using PDO::ERRMODE_EXCEPTION which is great for debugging—it gives you detailed error messages. Just remember to switch to PDO::ERRMODE_SILENT or PDO::ERRMODE_WARNING when you push to production to avoid exposing sensitive info to users.

内容的提问来源于stack exchange，提问作者Karl Schmidt