I am having trouble accessing AWS RDS instance in a private subnet using session manager through ec2 instance (Ubuntu).

Port forwarding using AWS Session manager -

    aws ssm start-session --target $INSTANCE_ID \
                       --document-name AWS-StartPortForwardingSession \
                       --parameters '{"portNumber":[3307],"localPortNumber":["8000"]}' \
                                             --profile=production \

Now local port 8000 successfully forwarded to port 3307 of EC2.

lsof -nP +c 15 | grep LISTEN

session-manager 59744 xrage 12u IPv4 0xa6c821d0a800e9a1 0t0 TCP (LISTEN)

EC2 instance has an iptable rule that forward all traffic on port 3307 to rds host at port 3306 (MYSQL PORT).

sudo iptables -t nat -A OUTPUT -o lo -d -p tcp --dport 3307 -j DNAT  --to-destination <rds_private_ip>:3306

This allowed me to access remote host on the desired port from ec2, But still, the remote host is not accessible locally on port 8000.

Network details on the local machine -

  • Not using any proxy
  • Firewall disabled on mac

So it's clear that SSM setup is working but something else is blocking this traffic, Need some help here.

2 Answers 2


When you said that remote host can access MySQL instance, u tried that port (telnet) or mysql command line client, just to confirm?

Assuming yes to the above, I would move on to the next step. It is my understanding that AWS-StartPortForwardingSession is to cover this scenario: You have something running on your EC2, say MySQL db that you hand rolled and installed. You want to forward traffic from your workstation (for example) to the MySQL instance running on EC2, via SSM. That's what AWS-StartPortForwardingSession was designed for.

In your case, the EC2 is more of a bastion host, and your MySQL instance is RDS type. So your EC2 does not host anything -- it simply is a gateway to connect to your RDS.

Assuming the above assumption is correct, I would use AWS-StartSSHSession instead (https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-getting-started-enable-ssh-connections.html).

The full answer would be verbose, but I just did it a few months ago: https://medium.com/@clearwaterstream/recipe-connect-to-an-rds-database-in-a-private-subnet-from-your-workstation-over-https-c66db6ead9f0

  • Yes, your assumptions are correct and my ec2 instance is working as bastion host only. And yes It worked with AWSStartSSH session, but ssh data will be encrypted and can not be logged for auditing that's why I was trying this approach.
    – xrage
    Commented Apr 11, 2020 at 4:23
  • I am still curious why this solution is not working.
    – xrage
    Commented Apr 11, 2020 at 4:24
  • @xrage Just a thought: The fact there is encryption in-place and that you cannot "snort" the traffic is a good thing, in my opinion. I think auditing (which commands were executed, session info and user info, etc) should be logged at the DB level, not at transport level. This way you can connect whichever way to the DB and have audit logging in place ...
    – Igor K
    Commented Apr 16, 2020 at 13:22

On May 27, 2022, AWS announced support for Port Forwarding to Remote Hosts using Session Manager:

To get started, install SSM Agent version 3.1.1374.0 or later on the managed instances that you are establishing a port forwarding session with. You can start a port forwarding session from the command line using the AWS-StartPortForwardingSessionToRemoteHost Session Manager document.

To start a port forwarding session, run the following command from the CLI. Replace the values of <EC2_INSTANCE_ID>, <RDS_DB>, <RDS_PORT>, and <LOCAL_PORT> with your information:

aws ssm start-session \
    --target <EC2_INSTANCE_ID> \
    --document-name AWS-StartPortForwardingSessionToRemoteHost \
    --parameters '{"host":["<RDS_DB>"], "portNumber":["<RDS_PORT>"], "localPortNumber":["<LOCAL_PORT>"]}'

More details are available in AWS Documentation: AWS Systems Manager - User Guide - Session Manager - Starting a Session (Port Forwarding to Remote Host).

Related AWS Blog Posts:

Related GitHub Issues and Pull Requests:

Related StackOverflow Question:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .