1. Create an RDS MySQL Database Instance
In the AWS Console, open RDS and create a database. Choose "MySQL" as engine and select a template that fits your needs ("Free tier" is enough for testing). Set the master username and password; you will use these credentials in MySQL Workbench.
Technical Details: Under "Connectivity", set "Public access" to "Yes" if you want to connect from your own computer. Instances without public access are only reachable from inside the VPC (or through a bastion host / VPN).
2. Allow Inbound MySQL Traffic in the Security Group
Open the security group attached to the database instance and add an inbound rule with type "MYSQL/Aurora" (TCP port 3306). For the source, choose "My IP" so only your computer can reach the database.
Technical Details: Do not use 0.0.0.0/0 as source. That opens the database to the whole internet and is a common cause of compromised databases.
3. Find the Database Endpoint
Wait until the database status is "Available". On the database page, "Connectivity & security" tab shows the endpoint (something like mydb.xxxxxxxx.eu-central-1.rds.amazonaws.com) and port (3306 by default). You will need both in the next step.
4. Create a Connection in MySQL Workbench
Open MySQL Workbench and click the "+" button next to "MySQL Connections". Use "Standard (TCP/IP)" as connection method. Enter the endpoint as hostname, 3306 as port, and the master username from Step 1. Store the password in the keychain/vault when prompted.
5. Test and Open the Connection
Click "Test Connection". If it succeeds, save and open the connection; you can now create schemas and run queries against the RDS instance.
Troubleshooting: If the connection times out, re-check Step 1 (public access must be "Yes") and Step 2 (your current IP must be allowed in the security group; it changes when you switch networks).
6. Cleanup
Please do not forget to delete resources if you do not need them.
1. Link For Deleting RDS Instance (skip the final snapshot only if you do not need the data)
2. Remove the inbound rule added in Step 2 if the security group is shared with other resources.