Using SageMaker Notebook with IAM DB authenticated Neptune database

Question

How do I configure the notebook so it can connect to the Neptune database that has IAM DB Authentication enabled? I received "Missing authentication token" error message when running `%status` in the notebook cell.

**Update 1**: The IAM role also has the policy to access neptune as well. Here is the excerpt of it:

```
 {
       "Action": "neptune-db:*",
       "Effect": "Allow",
       "Resource": "arn:aws:neptune-db:region:account-id:cluster-resource-id/*",
 }
```
Is there additional permissions that need to be included?

**Update 2**: After adding the proper resource ARN, I am able to query the database. However when the IAM DB Authentication option for neptune  is set to true, I received "Missing authentication token" when running queries from notebook

```
{
  "code": "AccessDeniedException",
  "requestId": "84c4efd9-370b-065d-e3b8-bb3389bb96d0",
  "detailedMessage": "Missing Authentication Token"
}
```

Accepted Answer

You need to ensure that your notebook configuration is set with the proper IAM configuration:

Use `%graph_notebook_config` to fetch the current config:

```
{
  "host": "neptunedbcluster-xxxxxxxxxx.cluster-xxxxxxxxxx.us-west-2.neptune.amazonaws.com",
  "port": 8182,
  "proxy_host": "",
  "proxy_port": 8182,
  "auth_mode": "DEFAULT",
  "load_from_s3_arn": "",
  "ssl": true,
  "ssl_verify": true,
  "aws_region": "us-west-2",
  "sparql": {
    "path": "sparql"
  },
  "gremlin": {
    "traversal_source": "g",
    "username": "",
    "password": "",
    "message_serializer": "graphsonv3"
  },
  "neo4j": {
    "username": "neo4j",
    "password": "password",
    "auth": true,
    "database": null
  }
}
```

Then set a new config using `%%graph_notebook_config` (note the two `%` this time) along with the updated JSON included in the body of the cell.  You'll need to change the `auth_mode` parameter to `IAM` in order for the cell magics to use IAM Authentication when communicating with Neptune.

Answer

Hi, your resource ARN is incorrect.

As per https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonneptune.html#amazonneptune-resources-for-iam-policies, proper syntax is `arn:${Partition}:neptune-db:${Region}:${Account}:${RelativeId}/database`

So, fix it and it should be fine: you can omit some parts: region, account, etc. to make them implicit. But you must keep the corresponding colons for those parts that you omit (region, account).

Best,

Didier

Using SageMaker Notebook with IAM DB authenticated Neptune database

Relevant content