Accessing RDS from within a Docker container not getting through security group?

Yes, containers do hit the public IPs of RDS. But you do not need to tune low-level Docker options to allow your containers to talk to RDS. The ECS cluster and the RDS instance have to be in the same VPC and then access can be configured through security groups. The easiest way to do this is to:

1. Navigate to the RDS instances page
2. Select the DB instance and drill in to see details
3. Click on the security group id
4. Navigate over to the Inbound tab and choose Edit
5. And ensure there is a rule of type MySQL/Aurora with source Custom
6. When entering the custom source, just start typing in the name of the ECS cluster and the security group name will be auto-completed for you

This tutorial has screenshots that illustrate where to go.

Full disclosure: This tutorial features containers from Bitnami and I work for Bitnami. However the thoughts expressed here are my own and not the opinion of Bitnami.

Figured out what was happening, posting here in case it helps anyone else.

Requests from within the container were hitting the public ip of the RDS rather than the private (which is how the security groups work). It looks like the DNS inside the docker container was using the 8.8.8.8 google dns and that wouldn't do the AWS black magic of turning the rds endpoint into the private ip.

So for instance:

DOCKER_OPTS="--dns 10.0.0.2 -H tcp://127.0.0.1:4243 -H unix:///var/run/docker.sock -g /mnt/docker"

The inbound rule for the RDS should be set to the private IP of the EC2 instance rather than the public IPv4.