How to set up cross-account access through IAM Authentication in Aurora MySQL RDS?

Question

We're trying to set up a cross-account configuration where a glue job in Account A connects and pulls data from a DB in an Aurora MySQL RDS cluster in Account B, using IAM authentication.

We've followed the steps detailed in these two articles:
* https://aws.amazon.com/blogs/database/securing-amazon-rds-and-aurora-postgresql-database-access-with-iam-authentication/
* https://repost.aws/knowledge-center/users-connect-rds-iam

When trying to connect through the glue job, we get "Access denied for db_user@ip_address", where the ip_address is in the range of the CIDR blocks we configured.

Here is a summary of what we did:

**In account A (glue job)
1. Added a new policy to the glue job's role allowing it to perform the assume role action, where the resource is the ARN of the iam role in Account B DB that allows the rds-db:connect action
2. Within the code, assume the role using boto3

**In Account B (db)
1. Created a new IAM role that has as trust policy the allowance for glue service and the glue job's arn to assume the role.
2. Added a policy to role in step 1 that allows to perfom the rds-db:connect action on the resource on the cluster id/db_user
3. Created a new db_user with AWSIAMAuthentication in MySql db
4. Added the CIDR blocks from glue job's security group to the inbound rules of the RDS cluster's security group

Regards,
Dante

Accepted Answer

I wanted to give an update in case anyone else has the same issue.

The problem was not with the configuration I detailed in my main post, but with the way we were trying to connect using boto3 (aws SDK for Python). Since we need to assume a role (programmatically) we also needed to use that role's credentials to generate the token (using the generate_auth_token method).

This is explained here: https://repost.aws/knowledge-center/lambda-function-assume-iam-role

Answer

Try adding the rds-db:connect permission to the Glue role in Account A. If you look at the following, it shows that the permission needs to be allowed in both accounts.

[Cross-account policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic-cross-account.html)

Second suggestion: Could it be related to this? You mentioned IP addresses. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html#UsingWithRDS.IAMDBAuth.GlobalContextKeys

How to set up cross-account access through IAM Authentication in Aurora MySQL RDS?

Relevant content