Authentication Error while trying to connect to a RDS Proxy from .NET Lambda using IAM Authentication

Question

Hello ,
I am trying to connect  to a RDS Proxy  form a .NET 8 Lambda using IAM Authentication and I am getting the following error

Authentication Error :Authentication to host '' for user '' using method 'mysql_clear_password' failed with message: Access denied for user 'rdsproxyuser'@' (using password: NO).

I have confirmed the following
1. **IAM authentication** is set as required in the RDS Proxy
2. RDS has Password and IAM database authentication enabled
3. The  is present in the database and  plugin is  AWSAuthenticationPlugin and host is %
4. Lambda has policy for IAM database access and secret access.

The code for creating the connection is

```
  public async Task CreateConnectionAsync()
   {
       var rdsProxyEndpoint = Environment.GetEnvironmentVariable(RDSEndPoint);
       var dbUser = Environment.GetEnvironmentVariable(DbUser);
       var awsRegion = Environment.GetEnvironmentVariable(AWSRegion);

if (string.IsNullOrEmpty(rdsProxyEndpoint) || string.IsNullOrEmpty(awsRegion) ||
           string.IsNullOrEmpty(dbUser))
       {
           throw new InvalidOperationException($"Environment variables are not properly set.");
       }

var token = await GenerateAuthTokenAsync(rdsProxyEndpoint, dbUser, awsRegion);
       var connectionStringBuilder = new MySqlConnectionStringBuilder
       {
           Server = rdsProxyEndpoint,
           Database = DbName,
           UserID = dbUser,
           Password = token,
           Port = 3306,
           SslMode = MySqlSslMode.Required,
           DefaultCommandTimeout = 30,
       };
       return new MySqlConnection(connectionString);
   }
   private async Task GenerateAuthTokenAsync(string endpoint, string username, string region)
   {
       var regionEndpoint = RegionEndpoint.GetBySystemName(region);
       var credentials = FallbackCredentialsFactory.GetCredentials();
       return await RDSAuthTokenGenerator.GenerateAuthTokenAsync(credentials, regionEndpoint, endpoint, Port, username);
   }
```

Has anybody faced this issue. Any help is appreciated

Thanks
Sabarish

re:Post Agent · Answer

It appears that you're encountering an authentication error while trying to connect to an RDS Proxy from a .NET 8 Lambda function using IAM Authentication. Based on the information provided, there are a few potential issues and solutions to consider:

1. Token Property: When using IAM authentication with RDS Proxy, you shouldn't use the password field in the connection string. Instead, you need to provide the appropriate token property for the database driver you're using. For .NET, you should use the `AccessToken` property instead of setting the token as the password.

2. Connection String Modification: Modify your connection string to use the `AccessToken` property. Your connection string builder should look something like this:

```csharp
   var connectionStringBuilder = new MySqlConnectionStringBuilder
   {
       Server = rdsProxyEndpoint,
       Database = DbName,
       UserID = dbUser,
       Port = 3306,
       SslMode = MySqlSslMode.Required,
       DefaultCommandTimeout = 30,
   };
   connectionStringBuilder.AccessToken = token;
   ```

3. SSL/TLS: Ensure that you're using Transport Layer Security (TLS)/Secure Sockets Layer (SSL) when connecting. You've already set `SslMode = MySqlSslMode.Required`, which is correct.

4. IAM Role Permissions: Double-check that the IAM role associated with your Lambda function has the necessary permissions to generate the auth token and access the RDS Proxy. The role should have permissions for `rds-db:connect` action on the resource ARN of your RDS instance.

5. Secrets Manager: If you're using AWS Secrets Manager to store database credentials, ensure that the Lambda function has permissions to access the secrets.

6. Proxy Configuration: Verify that the RDS Proxy is correctly configured to use IAM authentication and that the database user is set up properly for IAM auth in both the proxy and the underlying RDS instance.

7. Network Configuration: Ensure that the Lambda function is in the same VPC as the RDS Proxy or has network access to it.

If you've confirmed all these points and are still facing issues, you may want to enable detailed logging in your Lambda function to capture more information about the connection attempt. Also, check the CloudWatch logs for the RDS Proxy to see if there are any additional error messages or clues about the authentication failure.

Remember that when using IAM authentication with RDS Proxy, the process is slightly different from connecting directly to an RDS instance. The proxy handles the authentication process, so make sure you're following the specific guidelines for RDS Proxy IAM authentication.  
**Sources**  
[Connecting to a database through RDS Proxy - Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-connecting.html)  
[RDS Proxy concepts and terminology - Amazon Relational Database Service](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.howitworks.html)  
[Targeted business outcomes - AWS Prescriptive Guidance](https://docs.aws.amazon.com/prescriptive-guidance/latest/amazon-rds-proxy/targeted-business-outcomes.html)

Sab · Answer

I have documented our experience with RDS Proxy and .NET Lambda in the following article:- https://dev.to/techtrailwithsab/using-rds-proxy-with-a-net-lambda-for-efficient-database-connections-2a65

Hope this is useful !!!

Authentication Error while trying to connect to a RDS Proxy from .NET Lambda using IAM Authentication

Add your answer

Relevant content