Connection denied despite username/password correct

[covelloz]

bug description

I'm trying to connect to a non-production AWS RDS database instance (mysql).
I am getting a connection error. The host, driver, port, database, username, and password are all correct - I've confirmed. I can connect to it in other programs (i.e IntelliJ) and directly in the terminal via mysql command line tool.

Also, another odd thing is that I can connect to another AWS RDS database instance (with rainfrog) that is purely a reader instance. The one that I'm failing to connect to is a writer instance. Are there any error logs I can look at besides what is outputted to console? Any debugging tips? I wouldn't mind building from source and debugging the program if I can get some direction.

technical details

rainfrog error: Something went wrong
Error:
   0: error returned from database: 1045 (28000): Access denied for user '<username>'@'<ip>' (using password: YES)
   1: 1045 (28000): Access denied for user '<username>'@'<ip>' (using password: YES)

Note: <redacted> username/ip

system info

• macOS 26.1 (Darwin)
• rainfrog 0.3.8-VERGEN_IDEMPOTENT_OUTPUT (2025-10-11)
• Alacritty + zsh

crash logs

N/A

steps to reproduce

A) Try to connect using rainfrog, selecting db config by name, and copy-pasting the password.
or
B) Try to connect using rainfrog --url ...

expected behavior

If the host, driver, port, database, username, and password are all valid it should connect to the database.

[achristmascarl]

Thank you for the report. @covelloz are you connecting to it via a local tunnel? I.e. was <ip> either 127.0.0.1 or localhost?

I ask because Googling the error led me here: https://stackoverflow.com/questions/10299148/mysql-error-1045-28000-access-denied-for-user-billlocalhost-using-passw

So if that's the case, could you try running SELECT CAST(user AS CHAR(100)), host FROM mysql.user; to see if you have an anonymous user on the writer instance?

[covelloz]

@achristmascarl no it was a bit more complicated than that 😅. My local mysql connections work just fine (docker containers) actually. No problem there.

I was trying to connect to an AWS RDS instance (hosted) - a non-production instance which requires a corporate VPN setup properly to reach the private VPC/subnet. It was <username>@<ip> where the username was the value in my rainfrog config file and was my actual IPv4 address.

Thanks for the link. I'll have to check the mysql.user table and see if there's any discrepancy there between who is allowed and the IP. That's a good lead. I've run into that locally once or twice in the past where I've had to add a username@% entry into the mysql.user table in order to connect properly because there was only a user registered for username@localhost.

Is it possible that the <ip> address is incorrect (because of the VPN)? Like rainfrog doesn't take into account the VPN? But other programs (i.e IntelliJ/mysql) are able to resolve it properly? 🤔

[achristmascarl]

I see, so the <ip> was the IPv4 of the database instance, and that IP is only reachable from your computer if your corporate VPN is running (and allowing you to reach the instance in the private subnet via the VPN)? Or is <ip> the IP assigned to you by your ISP?

And when you mention being able to connect to the AWS RDS reader instance, is that also in the same subnet as the write instance, and also requires your corporate VPN to be running?

If you're able to share the name of your corporate VPN, that may help too. Thanks @covelloz

[covelloz]

@achristmascarl I believe it was the IPv4 of my machine. I'll have to double-check the <ip> and get back to you!

Yes, the other AWS RDS reader instance (that worked) also has a private VPC/subnet which requires being connected to the corporate VPN setup to access. AWS VPN.

[achristmascarl]

@covelloz got it, and let me know if you are able to find the <ip> in the mysql.user table. Do you know what version of MySQL the server is on?

[covelloz]

@achristmascarl OK so I did a bit of digging and found some inconsistencies when connecting:

I'm going to use 10.2.2 as a fake IP example for the VPC server and 10.1.1 as the client/host machine under the VPN.

1. Connecting using msqyl cli tool succeeds. For example, mysql -h <hostname> -u <username> -D <database> -p.
   Then, running a query SELECT USER(); prints <username>@<10.2.2>

2. Connect using rainfrog cli fails. For example, rainfrog --driver mysql --host <hostname> --port 3306 --username <username> --database <database>.

Error:
   0: error returned from database: 1045 (28000): Access denied for user '<username>'@'10.1.1' (using password: YES)
   1: 1045 (28000): Access denied for user '<username>'@'10.1.1' (using password: YES)

---

Also, I checked nslookup <hostname> and the Address matches the RDS instance vpc server ( 10.2.2 ).

Not sure why mysql & rainfrog are using different IPs? That seems odd. It does not happen on the other RDS instance. The other RDS instance uses 10.1.1 for both mysql/rainfrog. This might be a quirk on our end with DNS/proxy setup for the specific (problematic) RDS instance as well as mysql.user setup. But yeah, just wanted to give you an update. I'm still investigating.