RDS resolves to public IP from within VPC

Question

I'm working with an EC2 instance running Ubuntu 20.04 and RDS; both are in the same VPC. I've added security groups to allow connections to the RDS from the EC2 instance.

I am having an issue where a ping to the RDS instance from the EC2 resolves to the the public IP instead of the private IP and so the mysql connection fails; the connection succeeds if I use the inernal IP so its not an issue of not being accessible.

I am assuming this is related to some DNS cache but I've tried flushing and still down't work. The commands I've tried are below:

sudo systemd-resolve --flush-caches
sudo /etc/init.d/dns-clean start

Any ideas how we can solve this issue? How can the rds endpoint to resolve to the internal IP?

Answer 1

For improved security, it is better to use PubliclyAccessible = No. This will cause the DNS Name to resolve to a private IP that is only accessible from within the VPC. It will also assist with using Security Groups to control access to the database.