AWS Lambda in Java Cannot Connect to RDS using password: Access Denied Error for User 'admin'

0

I've deployed an AWS Lambda function written in Java that needs to connect to an RDS MySQL database. However, I'm encountering an "Access denied for user 'admin'@'172.30.49.57' (using password: YES)" error in the Lambda logs. Here's an overview of my setup and what I've checked so far:

Lambda Configuration:

  • Runtime: java17

  • Memory: 512 MB

  • Timeout: 300 seconds

  • VPC Configured with subnets: [Allow IPv6 traffic = false, subnet-01c4a541d35b432d3(Private), subnet-09fb788a99e6a5d3e (Private)] and security groups: [sg-0ca99160443168dba (default), sg-0c1cfc93ecb7f3f4c (rds-rdsproxy-2), sg-052e055d8b9a40bc1 (my-db-sg) | my-db-mysql-security-group , sg-0726e010ca51fb672 (rdsproxy-lambda-2), sg-0fb411f522f101a61 (lambda-rdsproxy-2)]

  • Environment Variables: DB credentials and RDS proxy host

RDS Configuration:

  • Instance: my-db, Class: db.r5.large, Engine: mysql, Version: 8.0.35
  • Publicly Accessible
  • Security Groups: rds-rdsproxy-2 (sg-0c1cfc93ecb7f3f4c), my-db-sg (sg-052e055d8b9a40bc1)
  • Proxy Endpoint: proxy-XXXXX-my-db.proxy-ckeyagwkfxol.us-east-2.rds.amazonaws.com
  • Database authentication: Password authentication

Security Group and Network:

  • Verified Lambda and RDS instances are in the same VPC.
  • Ensured the security groups allow inbound and outbound traffic between Lambda and RDS. IAM Role:

The Lambda execution role has necessary permissions. I've double-checked the database username, password, and connection string. Everything seems correct, but the connection still fails.

Additionally, the admin user on RDS has extensive permissions, including GRANT OPTION and rights to SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, etc., on all databases, which suggests that permission issues within the MySQL database are unlikely to be causing the access denial.

Has anyone faced a similar issue or can point out what I might be missing? Any help would be greatly appreciated.

2 Answers
1
Accepted Answer

Hello.

Have you configured the secret manager?
If you use an RDS proxy, you must configure a secret manager to store the RDS password and make it accessible from the RDS proxy.
https://aws.amazon.com/jp/blogs/compute/using-amazon-rds-proxy-with-aws-lambda/

profile picture
EXPERT
answered 2 months ago
profile picture
EXPERT
reviewed a month ago
  • It was indeed the secret manager issue. Thanks !

0

Hi Rohan,

You Access denied can come from various issues, so without more information on the permissions, the java code and RDS configuration, it's hard to help much more. But let's step back a bit if you don't mind.

I'm concerned to see that your RDS instance is "Publicly Accessible". This is considered bad practice and can have serious consequences. I invite you to put your RDS in a private subnet and configure your lambda to access your RDS instance through an RDS proxy with IAM authentification instead.

I encourage you to read about RDS Proxy for managing database connections, especially if your Java Lambda function makes frequent short database connections or opens and closes many connections. RDS Proxy helps in managing connection pooling, thus allowing your Lambda function to scale without exhausting database connections. Here is a short intro video about RDS Proxy.

Great tutorial here : Using Amazon RDS Proxy with AWS Lambda

Another great start is : How do I configure a Lambda function to connect to an RDS instance?

profile pictureAWS
answered 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions