Configuring Amazon RDS with IAM Authentication

When creating a new database instance, you can choose to enable IAM database authentication. See Amazon RDS guidance here.

For any existing database instance:

1. In the AWS console, select Modify for the given database instance.

2. Go to Database Authentication to select Password and IAM Database authentication.

3. Click Continue.

4. Select when to apply modifications.

5. Click modify DB instance. If you choose the option, Apply immediately, AWS may take a few minutes to restart the database.

1. In the AWS console, go to Policies.

2. Create a new policy with the following JSON. Update our placeholders with your corresponding values.

   • <resource_id> and <db_user> can be replaced with wildcard *

   • Resource ID is found in RDS > Databases > Database Instance > Configurationtab.

   • Add as many resources as desired and combinations for the ARN.

   JSONCopy

   { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "rds-db:connect" ], "Resource": [ "arn:aws:rds-db:<region>:<account_id>:dbuser:<resource_id>/<db_user>" ] } ] }

   {
      "Version": "2012-10-17",
      "Statement": [
         {
            "Effect": "Allow",
            "Action": [
                "rds-db:connect"
            ],
            "Resource": [
                "arn:aws:rds-db:<region>:<account_id>:dbuser:<resource_id>/<db_user>"
            ]
         }
      ]
   }

1. In the AWs console, go to Clusters > Select Cluster where the worker node is deployed.

2. In the cluster, go to the Compute tab.

3. Click the node group name in the Node groups section.

4. In the node group's Details section, click the link provided under Node IAM role ARN.

5. Go to Add Permissions > Attach Policies to upload the policy you created in the previous steps.

Example JSON of the vault entry with the required properties:

{
    "port": "5431",
    "hostname": "database-iam.hostname.us-east-1.rds.amazonaws.com",
    "region": "us-east-1",
    "db_user": "postgres",
    "connectionUrl": "jdbc:postgresql://database-iam.hostname.us-east-1.rds.amazonaws.com:5431/"
}