I am using the following Pulumi script (in Python) to attempt to create an RDS instance and a Lambda function which will connect with it. I create a security group for the RDS instance allowing inbound traffic from the Lambda through port 3306 and a security group for the RDS instance allowing inbound traffic from the Lambda security group. The lambda even shows as being “connected” to the RDS instance in the “Configuration -> RDS Databases” tab of the AWS UI. However, whenever I run the lambda, it cannot connect. I receive the error “Can’t connect to MySQL server on ‘mysql5748c55.c1wk2emosjje.us-west-2.rds.amazonaws.com:3306’ ([Errno -2] Name or service not known)”.

rds_sg = aws.ec2.SecurityGroup("rdsSG",
    ingress=[{
        "protocol": "tcp",
        "from_port": 3306,
        "to_port": 3306,
        "cidr_blocks": ["0.0.0.0/0"]
    }]
)

rds_instance = aws.rds.Instance('mysql',
    multi_az=False,
    allocated_storage=10,
    storage_type="gp2",
    engine="mysql",
    instance_class="db.t3.micro",
    db_name="mydb",
    username="redacted",
    password="redacted",
    vpc_security_group_ids=[rds_sg.id],
    skip_final_snapshot=True
)


snet_group_name = rds_instance.db_subnet_group_name
snet_group = aws.rds.SubnetGroup.get("rds_subnet_group", snet_group_name)

snet_id  = snet_group.subnet_ids[0]
snet = aws.ec2.get_subnet(id=snet_id)
vpc_id = snet.vpc_id
pulumi.export("vpc", vpc_id)

lambda_role = aws.iam.Role("lambdaRole",
    assume_role_policy="""{
        "Version": "2012-10-17",
        "Statement": [{
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {"Service": "lambda.amazonaws.com"}
        }]
    }""")

# Attach the AWSLambdaVPCAccessExecutionRole policy
aws.iam.RolePolicyAttachment('lambdaVPCAccessExecutionRole',
    role=lambda_role.name,
    policy_arn='arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole')

# Attach the AWSLambdaFullAccess policy
aws.iam.RolePolicyAttachment('lambdaFullAccess',
    role=lambda_role.name,
    policy_arn='arn:aws:iam::aws:policy/AWSLambda_FullAccess')

# Attach the AmazonRDSFullAccess policy
aws.iam.RolePolicyAttachment('rdsFullAccess',
    role=lambda_role.name,
    policy_arn='arn:aws:iam::aws:policy/AmazonRDSFullAccess')

lambda_sg = aws.ec2.SecurityGroup("lambdaSG",
    egress=[{
        "protocol": "tcp",
        "from_port": 3306,
        "to_port": 3306,
        "cidr_blocks": ["0.0.0.0/0"]
    }]
)


migrate_function = aws.lambda_.Function('migrateDB',
    runtime="python3.8",
    code=pulumi.FileArchive("./create_db"),
    handler="handler.handler",
    role=lambda_role.arn,
    environment=aws.lambda_.FunctionEnvironmentArgs(
        variables={
           "DB_ENDPOINT": rds_instance.endpoint,
           "DB_USER": "mysqladmin",
           "DB_PASS": "mypassword",
           "DB_NAME": "mydb"
        }
    ),
    vpc_config=aws.lambda_.FunctionVpcConfigArgs(
        subnet_ids=snet_group.subnet_ids,
        security_group_ids=[lambda_sg.id]
    )
)

invoke_lambda = aws.lambda_.Invocation("invokeMyFunction",
    function_name=migrate_function.name,
    input=json.dumps({"payload": "your-payload"}),  # Change the payload as per your function's requirement
    qualifier=migrate_function.version)
pulumi.export('lambda_invocation_response', invoke_lambda.result)

I have verified that all environment variables used by the lambda (including the endpoint) are correct. I have also inspected the inbound and outbound rules manually in the amazon UI to verify that they are configured to allow traffic between the RDS SG and the Lambda SG. I have verified that the Lambda and the RDS instance are on the same VPC. Does anyone know why this script fails to allow connection between the lambda and RDS instance? Thank you.