AWS Lambda in Java Cannot Connect to RDS using password: Access Denied Error for User 'admin'

0

I've deployed an AWS Lambda function written in Java that needs to connect to an RDS MySQL database. However, I'm encountering an "Access denied for user 'admin'@'172.30.49.57' (using password: YES)" error in the Lambda logs. Here's an overview of my setup and what I've checked so far:

Lambda Configuration:

  • Runtime: java17

  • Memory: 512 MB

  • Timeout: 300 seconds

  • VPC Configured with subnets: [Allow IPv6 traffic = false, subnet-01c4a541d35b432d3(Private), subnet-09fb788a99e6a5d3e (Private)] and security groups: [sg-0ca99160443168dba (default), sg-0c1cfc93ecb7f3f4c (rds-rdsproxy-2), sg-052e055d8b9a40bc1 (my-db-sg) | my-db-mysql-security-group , sg-0726e010ca51fb672 (rdsproxy-lambda-2), sg-0fb411f522f101a61 (lambda-rdsproxy-2)]

  • Environment Variables: DB credentials and RDS proxy host

RDS Configuration:

  • Instance: my-db, Class: db.r5.large, Engine: mysql, Version: 8.0.35
  • Publicly Accessible
  • Security Groups: rds-rdsproxy-2 (sg-0c1cfc93ecb7f3f4c), my-db-sg (sg-052e055d8b9a40bc1)
  • Proxy Endpoint: proxy-XXXXX-my-db.proxy-ckeyagwkfxol.us-east-2.rds.amazonaws.com
  • Database authentication: Password authentication

Security Group and Network:

  • Verified Lambda and RDS instances are in the same VPC.
  • Ensured the security groups allow inbound and outbound traffic between Lambda and RDS. IAM Role:

The Lambda execution role has necessary permissions. I've double-checked the database username, password, and connection string. Everything seems correct, but the connection still fails.

Additionally, the admin user on RDS has extensive permissions, including GRANT OPTION and rights to SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, etc., on all databases, which suggests that permission issues within the MySQL database are unlikely to be causing the access denial.

Has anyone faced a similar issue or can point out what I might be missing? Any help would be greatly appreciated.

2 回答
1
已接受的回答

Hello.

Have you configured the secret manager?
If you use an RDS proxy, you must configure a secret manager to store the RDS password and make it accessible from the RDS proxy.
https://aws.amazon.com/jp/blogs/compute/using-amazon-rds-proxy-with-aws-lambda/

profile picture
专家
已回答 2 个月前
profile picture
专家
已审核 2 个月前
  • It was indeed the secret manager issue. Thanks !

0

Hi Rohan,

You Access denied can come from various issues, so without more information on the permissions, the java code and RDS configuration, it's hard to help much more. But let's step back a bit if you don't mind.

I'm concerned to see that your RDS instance is "Publicly Accessible". This is considered bad practice and can have serious consequences. I invite you to put your RDS in a private subnet and configure your lambda to access your RDS instance through an RDS proxy with IAM authentification instead.

I encourage you to read about RDS Proxy for managing database connections, especially if your Java Lambda function makes frequent short database connections or opens and closes many connections. RDS Proxy helps in managing connection pooling, thus allowing your Lambda function to scale without exhausting database connections. Here is a short intro video about RDS Proxy.

Great tutorial here : Using Amazon RDS Proxy with AWS Lambda

Another great start is : How do I configure a Lambda function to connect to an RDS instance?

profile pictureAWS
已回答 2 个月前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则