Steps taken: 1. Created the IAM user rds-user which has the rds-db:connect permissions for the cluster. ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds-db:connect" ], "Resource": [ "arn:aws:rds-db:eu-west-1:11111111111:dbuser:example-db/rds-test" ] } ] } ``` 2. Enabled RDS IAM Authentication on the Cluster. 3. Created the rds-test user inside postgres and granted the rds_iam role. 4. Generated an AWS authentication token ``` export RDSHOST="example-db.eu-west-1.rds.amazonaws.com" export PGPASSWORD="$(aws rds generate-db-auth-token --hostname $RDSHOST --port 5432 --region us-west-1 --username rds-test)" psql "host=$RDSHOST port=5432 sslmode=verify-full sslrootcert=eu-west-1-bundle.pem dbname=postgres user=rds-test password=$PGPASSWORD" ``` Output: ``` FATAL: password authentication failed for user "rds-test" ``` The SSL certificate is not expired.

Cannot connect to RDS Postgres using the IAM Authentication

Steps taken:

Created the IAM user rds-user which has the rds-db:connect permissions for the cluster.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds-db:connect"
            ],
            "Resource": [
                "arn:aws:rds-db:eu-west-1:11111111111:dbuser:example-db/rds-test"
            ]
        }
    ]
}

Enabled RDS IAM Authentication on the Cluster.
Created the rds-test user inside postgres and granted the rds_iam role.
Generated an AWS authentication token

export RDSHOST="example-db.eu-west-1.rds.amazonaws.com"
export PGPASSWORD="$(aws rds generate-db-auth-token --hostname $RDSHOST --port 5432 --region us-west-1 --username rds-test)"
psql "host=$RDSHOST port=5432 sslmode=verify-full sslrootcert=eu-west-1-bundle.pem dbname=postgres user=rds-test password=$PGPASSWORD"

Output:

FATAL:  password authentication failed for user "rds-test"

The SSL certificate is not expired.

主题

安全、身份和合规性迁移与现代化分析数据库

标签

AWS 身份和访问权限管理 Amazon Relational Database Service 极光 PostgreSQL 数据库

语言

English

Alex

已提问 1 个月前178 查看次数

1 回答

最新
投票最多
评论最多

这些答案有用吗？为正确答案投票，以帮助社区从您的知识中受益。

Hello.

I recommend that you first review all troubleshooting methods in the documentation below.
https://repost.aws/knowledge-center/aurora-postgresql-connect-iam

By the way, is the ARN set in the IAM policy correct?
If you try changing the ARN to "*" and are able to connect, the ARN may be incorrect.

"arn:aws:rds-db:eu-west-1:11111111111:dbuser:example-db/rds-test"

专家

Riku_Kobayashi

已回答 1 个月前

专家

Antonio_Lagrotteria

已审核 1 个月前

Alex
1 个月前
Hi,

I also tried matching all DB clusters and database accounts using this ARN: "arn:aws:rds-db:us-east-2:1234567890:dbuser:/" and it resulted in the same issue, if that's what you meant.

https://repost.aws/knowledge-center/aurora-postgresql-connect-iam - It is mentioned here that my issue might be cause by trying to connect to the DB without SSL which is not the case in this situation. "If you get an error similar to the one in this example, then the client is trying to connect to the DB instance without SSL."

Riku_Kobayashi 专家

1 个月前

For example, try checking the connection using the following IAM policy.

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
             "rds-db:connect"
         ],
         "Resource": [
             "arn:aws:rds-db:us-west-2:123456789012:dbuser:*/rds-test"
         ]
      }
   ]
}

By the way, the "psql" command uses SSL communication by default, so I thought it might be possible to connect without "sslmode=verify-full sslrootcert=eu-west-1-bundle.pem". In other words, I think it is possible to connect using the following connection method. https://medium.com/@tizattogabriel/how-to-authenticate-to-an-aws-rds-postgresql-db-instance-using-iam-credentials-4e69b095c01c

export RDSHOST="example-db.eu-west-1.rds.amazonaws.com"
export PGPASSWORD="$(aws rds generate-db-auth-token --hostname $RDSHOST --port 5432 --region us-west-1 --username rds-test)"
psql "host=$RDSHOST port=5432 dbname=postgres user=rds-test password=$PGPASSWORD"

Riku_Kobayashi 专家
1 个月前
Instead of using regional certificates, why not try using a certificate bundle that includes both intermediate and root certificates for all AWS Regions? https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

Cannot connect to RDS Postgres using the IAM Authentication

相关内容