Ingress rules on multi-AZ RDS security group needs RDS instance restart to take effect

When we add a new ingress rule to the security group to which a running RDS instance belongs, then it would need an instance restart to take effect. In case of MySQL RDS instance, you will see an error on mysql client

>mysql -h <rds instance url> -u <userid> -p
ERROR 2003 (HY000): Can't connect to MySQL server on '<rds instance>' (10060)

After restarting the instance, you will see that inbound connections from the EIP address that you have allowed will start working.