The endpoint resolves to a private address in the subnet group. Only something inside the VPC that the database's group lets in can connect: the app server, not CloudShell.
Where the app finds it
Put the endpoint in a parameter, so a database that moves means one change:
aws ssm put-parameter --name /market/db/endpoint --type String --value $EPThe app server reads it at start-up. In a Session Manager shell on it:
EP=$(aws ssm get-parameter --name /market/db/endpoint --query Parameter.Value --output text)psql
Amazon Linux has no PostgreSQL client until you install one, as in Chapter 3:
sudo dnf install -y postgresql16psql takes the endpoint (-h), the user (-U) and the database (-d). The password comes from PGPASSWORD; without it, fe_sendauth: no password supplied:
export PGPASSWORD=$(cat /opt/market/db-password)-f runs a file of SQL, here the catalogue: a table and its rows.
psql -h $EP -U market -d market -f /opt/market/catalogue.sql-c runs one command and prints psql's table:
psql -h $EP -U market -d market -c "SELECT name, price FROM monsters ORDER BY price DESC"-At prints bare values for scripts (psql -h $EP -U market -d market -At -c "SELECT count(*) FROM monsters" prints 8), and -c "\dt" lists the tables.
| psql says | Meaning |
|---|---|
Connection timed out | a security group (or the VPC) is in the way |
password authentication failed | wrong user or password |
relation "x" does not exist | connected; no such table |