AWS RDS – How to Specify an Option Group During Database Upgrade

amazon-rdsamazon-web-services

I have a Postgres database in AWS RDS currently running version 9.6.11, and I'm trying to perform a major upgrade to version 10.7. I've followed the Upgrade Guide to create a new version-compatible parameter group, and also created a new version-compatible option group just in case.

When I attempt to initiate the upgrade in the AWS Console, I get this error message.

However, there is no apparent place in the RDS console that allows me to specify a new Option Group. What am I missing? Is there something else that needs to be done so that I can upgrade through the Console, or am I required to use the CLI or REST API to accomplish this?

Best Answer

Databases can only be upgraded in the RDS Console if they use a default option group. (Presumably all databases created in the RDS Console also use the default option group.)

In my case, the database was created with a tool that invokes the RDS API. In order to upgrade my database, I needed to use either the RDS API or the AWS CLI as described on the Manual Upgrade page. The upgrade command looked like this:

$ aws rds modify-db-instance \
  --db-instance-identifier my-database-instance \
  --engine-version 10.7 \
  --db-parameter-group-name my-postgres10 \
  --option-group-name my-postgres10 \
  --allow-major-version-upgrade \
  --apply-immediately

Related Solutions

AWS RDS – How to Link a Security Group to an RDS Instance

When your RDS instance is not in a VPC, then your RDS instance is associated with an RDS security group. Those security groups are controlled by the "Security Groups" section in the RDS console. From there, you can add EC2-Classic security groups for access:

Select your RDS security group
Select "EC2 Security Group" for the "Connection Type"
Select this or another AWS account and fill in the other AWS account number if necessary
Select or fill in the correct security group.
Click "Authorize"

When your RDS instance is inside a VPC, then your RDS instance is associated with a VPC security group. Those security groups are controlled by the "Security Groups" section in the VPC console. From there, you can add other VPC security groups for access:

Select your VPC security group
Select the "Inbound Rules" tab
Click "Edit"
Add a new rule, select your protocol and port range. For "Source", type or select your security group. Only VPC security groups within the same VPC can be used for this purpose.
Click "Save"

Note, when selecting the security group, depending on the browser you're using, the list may only appear once focus is in the "Source" edit box. It may also only appear if you start typing. Also, it may not appear at all. If this is the case, type in the source VPC security group's identifier (eg. sg-12345678).

AWS add option group

I signed up for paid support and here's the answer, in case it helps anyone else. I had to edit the trust policy on the IAM role like so:

{
    "Version": "2012-10-17",
    "Statement":
    [{
        "Effect": "Allow",
        "Principal": {"Service":  "rds.amazonaws.com"},
        "Action": "sts:AssumeRole"
    }]
}

Then I was able to add the option to the option group and the restore worked. Note that the trust policy is called "trust relationship" on the web console.

Best Answer

Related Solutions

AWS RDS – How to Link a Security Group to an RDS Instance

AWS add option group

Related Topic