AWS can not change DB Subnet Group for AWS RDS

amazon-web-servicesrds

we have to (want to..) rename our DB Subnet Groups on AWS, so i created a new DB Subnet Group with same settings as the old one. When i want to switch the Group on "Modify Tab" in AWS GUI and hit apply, aws returns:

You cannot move DB instance XXX to subnet group XXX. The specified DB
subnet group and DB instance are in the same VPC. Choose a DB subnet
group in different VPC than the specified DB instance and try again.
(Service: AmazonRDS; Status Code: 400; Error Code:
InvalidVPCNetworkStateFault; Request ID:
7d46c84c-b22a-11e6-be20-b5bb6bd6cc6d)

Any suggestions? Or is it just not possible without recreating whole instance?

Best Answer

I had this same question a few months back, and ended up contacting AWS (I have Enterprise support). This was the result:

Unfortunately, moving DB instance subnet group to another subnet group in the same VPC is not supported at this time. I realize our documentation says that it is supported, but that is an error. We are currently working on updating our documentation to reflect this and I apologize for the mis-communication.

However, I do have a workaround, you can create a new temporary VPC, update the subnet group to point to that temporary VPC, then once that process completes, change the subnet group to point back to your new subnet group.

Alternatively, another way to do it would be to create a database snapshot, and spin up a new instance from the snapshot.

You might want to look at both approaches. Both methods will probably cause you some downtime unless you are able to run your application in read only mode for a while, or have a method of replaying transactions on the restored snapshot.

Related Solutions

AWS CloudFormation: VPC default security group

Referencing the default security group is possible using:

{ "Fn::GetAtt" : ["VPC", "DefaultSecurityGroup"] }

Where "VPC" is your VPC resource name.

With AWS::EC2::SecurityGroupIngress and AWS::EC2::SecurityGroupEgress, you can augment the permissions of this default security group.

I think this is what you want:

"VPCDefaultSecurityGroupIngress": {
  "Type" : "AWS::EC2::SecurityGroupIngress",
  "Properties" : {
    "GroupId": { "Fn::GetAtt" : ["VPC", "DefaultSecurityGroup"] },
    "IpProtocol":"tcp",
    "FromPort":"22",
    "ToPort":"22",
    "CidrIp":"0.0.0.0/0"
  }
},

As mentioned by @artbristol and @gabriel, this allows Ingress/Egress rules to be added to the default security group for the VPC in a single stack deployment.

I'm pretty sure that the self-referential problem still impacts any attempts at changing any of the other properties on the default security group of the VPC. A good example of this would be adding Tags, or a Description. If you wish to change these things, you'll have to deal with extraneous security groups laying around.

Mysql – access an AWS RDS read replica directly from Internet

I think that is impossible, a kind of AWS limitation. What seem to be the lowest/rawest way to interact with AWS (on which RDS Web Console and RDS Command Line are based on) not have a way to change that option.

Best Answer

Related Solutions

AWS CloudFormation: VPC default security group

Mysql – access an AWS RDS read replica directly from Internet

Related Topic