AWS AmazonRDS medium security documentation change
Summary
Added new troubleshooting section for IAM authentication failures with error examples and logging guidance
Security assessment
The change directly addresses security-related authentication failures by documenting troubleshooting for IAM DB Auth errors, expired credentials, and invalid tokens. It introduces security logging capabilities (iam-db-auth-error logs) to help identify authentication issues, which impacts security monitoring and incident response.
Diff
diff --git a/AmazonRDS/latest/AuroraUserGuide/mysql-troubleshooting-dbconn.md b/AmazonRDS/latest/AuroraUserGuide/mysql-troubleshooting-dbconn.md index db51d4703..389eb5cf3 100644 --- a//AmazonRDS/latest/AuroraUserGuide/mysql-troubleshooting-dbconn.md +++ b//AmazonRDS/latest/AuroraUserGuide/mysql-troubleshooting-dbconn.md @@ -30,0 +31,2 @@ Ensuring reliable connectivity between your applications and your RDS DB instanc + * [Example 3: Troubleshooting IAM failed connection attempts](./mysql-troubleshooting-dbconn.html#mysql-dbconn-example3) + @@ -577,0 +580,31 @@ In this example, the `connection.close()` method is called in the `finally` bloc +### Example 3: Troubleshooting IAM failed connection attempts + +Connectivity with AWS Identity and Access Management (IAM) users can fail for several reasons, such as: + + * Incorrect IAM policy configuration + + * Expired security credentials + + * Network connectivity issues + + * Database permission mismatches + + + + +To troubleshoot these authentication errors, enable the `iam-db-auth-error` log export feature in your Amazon Relational Database Service (RDS) or Aurora database. This will allow you to view detailed authentication error messages in CloudWatch Log group for your Amazon RDS or Amazon Aurora cluster. + +Once enabled, you can review these logs to identify and resolve the specific cause of your IAM authentication failures. + +For example: + + + 2025-09-22T12:02:30,806 [ERROR] Failed to authorize the connection request for user 'user_1' due to an internal IAM DB Auth error. (Status Code: 500, Error Code: InternalError) + +and + + + 2025-09-22T12:02:51,954 [ERROR] Failed to authenticate the connection request for user 'user_2' because the provided token is malformed or otherwise invalid. (Status Code: 400, Error Code: InvalidToken) + +For troubleshooting guidance, refer to the [Aurora](./UsingWithRDS.IAMDBAuth.Troubleshooting.html) troubleshooting guide for IAM DB authentication. +