Aurora Serverless v2 can't access s3Import credentials on resume

I think, but I'm not certain, that removing the

# Terraform
Condition = {
  StringEquals = {
    "aws:SourceArn" : "<ARN>"
  }
}

solved the problem for us. It was on a different DB, the one I referenced here was stopped when we stopped the project.

Again, I haven't done extensive testing, we haven't used this feature as much as we expected, but I suspect ARN of the DB was some how referencing a different internal ID. Much like if you delete and recreate an IAM role with the same name the ID the name references has changed. And, old references to the role need to be refreshed. My suspicion is that something like that is happening with the DB ARN. The resume of the cluster means a new resource ID is associated with the previous source ARN. As a simple readd of the same policy works, probably updating some internal, hidden links. The counter argument to that is why would AWS allow this bug to persist for so long in the docs.

:shrug:

To mitigate this issue, please consider increasing the minimum capacity and instead of setting it to 0, set a low but non-zero value (e.g., 0.5) to prevent complete pausing.