RDS Connection timeout

Rds Connection Timeout in AWS applications is misdiagnosed as a code bug more often than any other error type, because the error message surfaces in application logs with stack traces pointing to SDK calls — making it look like the SDK is broken rather than the permissions. The first diagnostic step for any AWS error is to verify permissions using a minimal test: run aws <service> <action> --debug 2>&1 | grep -i 'auth|permission|policy' with the AWS CLI using the same credentials as the application. If the CLI succeeds but the application fails, the credentials differ. If the CLI also fails, it is an IAM problem. Common misdiagnoses: an AccessDeniedException is always IAM, even if the error message mentions a resource name or action that looks like a code variable. A ValidationException is always input data — check the request payload. A ResourceNotFoundException might be IAM (the principal cannot see the resource) or genuinely missing. InvalidSignatureException is always a clock skew or credentials issue, not code logic. Systematically rule out IAM before changing application code.