AWS Lambda in Java Cannot Connect to RDS using password: Access Denied Error for User 'admin'

0

I've deployed an AWS Lambda function written in Java that needs to connect to an RDS MySQL database. However, I'm encountering an "Access denied for user 'admin'@'172.30.49.57' (using password: YES)" error in the Lambda logs. Here's an overview of my setup and what I've checked so far:

Lambda Configuration:

  • Runtime: java17

  • Memory: 512 MB

  • Timeout: 300 seconds

  • VPC Configured with subnets: [Allow IPv6 traffic = false, subnet-01c4a541d35b432d3(Private), subnet-09fb788a99e6a5d3e (Private)] and security groups: [sg-0ca99160443168dba (default), sg-0c1cfc93ecb7f3f4c (rds-rdsproxy-2), sg-052e055d8b9a40bc1 (my-db-sg) | my-db-mysql-security-group , sg-0726e010ca51fb672 (rdsproxy-lambda-2), sg-0fb411f522f101a61 (lambda-rdsproxy-2)]

  • Environment Variables: DB credentials and RDS proxy host

RDS Configuration:

  • Instance: my-db, Class: db.r5.large, Engine: mysql, Version: 8.0.35
  • Publicly Accessible
  • Security Groups: rds-rdsproxy-2 (sg-0c1cfc93ecb7f3f4c), my-db-sg (sg-052e055d8b9a40bc1)
  • Proxy Endpoint: proxy-XXXXX-my-db.proxy-ckeyagwkfxol.us-east-2.rds.amazonaws.com
  • Database authentication: Password authentication

Security Group and Network:

  • Verified Lambda and RDS instances are in the same VPC.
  • Ensured the security groups allow inbound and outbound traffic between Lambda and RDS. IAM Role:

The Lambda execution role has necessary permissions. I've double-checked the database username, password, and connection string. Everything seems correct, but the connection still fails.

Additionally, the admin user on RDS has extensive permissions, including GRANT OPTION and rights to SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, etc., on all databases, which suggests that permission issues within the MySQL database are unlikely to be causing the access denial.

Has anyone faced a similar issue or can point out what I might be missing? Any help would be greatly appreciated.

2 Respuestas
1
Respuesta aceptada

Hello.

Have you configured the secret manager?
If you use an RDS proxy, you must configure a secret manager to store the RDS password and make it accessible from the RDS proxy.
https://aws.amazon.com/jp/blogs/compute/using-amazon-rds-proxy-with-aws-lambda/

profile picture
EXPERTO
respondido hace 2 meses
profile picture
EXPERTO
revisado hace 2 meses
  • It was indeed the secret manager issue. Thanks !

0

Hi Rohan,

You Access denied can come from various issues, so without more information on the permissions, the java code and RDS configuration, it's hard to help much more. But let's step back a bit if you don't mind.

I'm concerned to see that your RDS instance is "Publicly Accessible". This is considered bad practice and can have serious consequences. I invite you to put your RDS in a private subnet and configure your lambda to access your RDS instance through an RDS proxy with IAM authentification instead.

I encourage you to read about RDS Proxy for managing database connections, especially if your Java Lambda function makes frequent short database connections or opens and closes many connections. RDS Proxy helps in managing connection pooling, thus allowing your Lambda function to scale without exhausting database connections. Here is a short intro video about RDS Proxy.

Great tutorial here : Using Amazon RDS Proxy with AWS Lambda

Another great start is : How do I configure a Lambda function to connect to an RDS instance?

profile pictureAWS
respondido hace 2 meses

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas