IAM Database Authentication lets you log in to your Amazon RDS database using your IAM credentials. This makes it easier to manage access, improves security, and provides more control over who can do what. Let’s look at how to set it up and use it effectively.
Objective:
IAM DB Authentication improves security, enables centralized user management, supports auditing, and ensures scalability for database access.
How it Works:
We can enable and use this feature in simple three steps:
- Enabling IAM DB authentication
- Enabling RDS access to AWS IAM User,
- Generating Token & Connecting DB using AWS IAM user.
To Enable IAM DB Authentication You Must Follow The Steps Below:
- Select the RDS instance
- Click on Modify Button
- Navigate DB Authentication button & Select the Password and IAM Database authentication
- For Lower version of RDS, it does not show this option, but you can enable it by using CLI
- Once you Selected, it will ask you to confirm the master password, after that click on modify option save the changes.
Enable RDS Access to AWS IAM User:
- Create and IAM policy
For example:
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: “rds-db:connect”,
“Resource”: “arn:aws:rds-db:<region>:<account-id>:dbuser:<db-cluster-id>/<username>”
}
]
}
- After creating the policy, Navigate the user whom you want to provide the access, attach that policy to user.
Connecting DB using AWS IAM User:
- first you must generate token to connect the RDB; to generate a token you can run below command
aws rds generate-db-auth-token –hostname <db endpoint url> –port 3306 –region <region> –username <db_username>
Make sure you have AWS configured, otherwise you will get the error below, to configure AWS you have to use your IAM AWS account which you want use to connect db.
- then after that you can connect mysql by passing that token in below command:
mysql –host=<db_endpoint_url> –port=3306 –ssl-ca=<provide ssl if you are using ssl> –user=<db_username> –password=’genrated_token_value’
Conclusion:
IAM DB Authentication makes it easier to manage access to your Amazon RDS databases by removing the need for hardcoded credentials. By following the above-mentioned steps, you can enable and use IAM-based authentication securely. This approach improves security, simplifies access control, and helps you stay compliant with your organization’s policies.
