When working with AWS RDS for PostgreSQL, connection timeouts are among the most common frustrations developers face. The error message psql: could not connect to server: Operation timed out typically indicates network-level issues rather than database authentication problems.

Before diving into complex troubleshooting, verify these fundamental settings:

# Basic connectivity test (replace with your endpoint)
nc -zv myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com 5432

If this fails, examine these AWS components:

Your RDS instance must reside in a public subnet with:

• Internet Gateway attached to VPC
• Route table with 0.0.0.0/0 -> igw-xxxx
• Public IP assignment enabled

Beyond just opening port 5432, consider these advanced settings:

# Example security group inbound rule that actually works:
Type: PostgreSQL
Protocol: TCP
Port Range: 5432
Source: 0.0.0.0/0 (or your specific IP)

Pro Tip: Temporarily add your current public IP (check via curl ifconfig.me) as a specific source.

The default VPC ACLs shown in your screenshot should allow traffic, but verify:

• Inbound Rule 100: Allow ALL Traffic (100-32767)
• Outbound Rule 100: Allow ALL Traffic (100-32767)

When basic checks pass but connections still fail, try these diagnostic commands:

# Test DNS resolution
dig +short myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com

# TCP connection test with timeout
timeout 5 telnet myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com 5432

# Traceroute to identify network hops
traceroute -T -p 5432 myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com

When standard psql fails, try these alternative connection methods:

# Using connection URI format
psql postgresql://masteruser:password@myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com:5432/testdb

# With SSL enforcement (AWS RDS requires this)
psql "host=myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com port=5432 dbname=testdb user=masteruser password=password sslmode=require"

Check your DB parameter group for these critical settings:

• listen_addresses = '*'
• password_encryption = 'scram-sha-256' (for newer PostgreSQL versions)
• ssl = '1'

For persistent connection issues:

1. Reboot the RDS instance (not ideal for production)
2. Create a new security group and assign to RDS
3. Test from an EC2 instance in the same VPC
4. Enable VPC Flow Logs to inspect traffic

Remember that AWS RDS instances sometimes take several minutes to apply network configuration changes, even when the console shows modifications as 'completed'.

---

When encountering "Operation timed out" errors with a publicly accessible PostgreSQL RDS instance, we need to verify multiple layers of AWS infrastructure. Let's break down the diagnostic process.

First, confirm your VPC settings match these requirements:

1. Public subnet must have an Internet Gateway attached
2. Route table should have 0.0.0.0/0 routed to igw-xxxxxxxx
3. RDS instance must be in a public subnet (not all subnets in a VPC are public)
4. Auto-assign public IP should be enabled for the subnet

While your security group appears open, AWS has some nuances:

// Bad practice (too open):
Type: PostgreSQL
Protocol: TCP
Port Range: 5432
Source: 0.0.0.0/0

// Better practice (restrict to your IP):
Type: PostgreSQL
Protocol: TCP
Port Range: 5432
Source: [Your Public IP]/32

The inbound rules shown allow all traffic, but check the outbound rules:

Rule # Type            Protocol  Port Range  Destination  Allow/Deny
100     All Traffic     All       All         0.0.0.0/0    ALLOW
*       All Traffic     All       All         0.0.0.0/0    DENY

Before using psql, run these diagnostic commands:

# Check basic connectivity
ping myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com

# Test port access (Linux/Mac)
nc -zv myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com 5432

# Windows alternative
Test-NetConnection myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com -Port 5432

For persistent connection issues, try these psql options:

psql "host=myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com \
      port=5432 \
      user=masteruser \
      dbname=testdb \
      connect_timeout=10 \
      sslmode=require"

If standard auth fails, consider IAM authentication:

# Generate IAM auth token
aws rds generate-db-auth-token \
  --hostname myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com \
  --port 5432 \
  --region us-east-1 \
  --username masteruser

# Connect with IAM token
psql "host=myinstance.xxxxxxxxxx.us-east-1.rds.amazonaws.com \
      port=5432 \
      user=masteruser \
      dbname=testdb \
      password=[generated_token]"