AWS aurora-dsql medium security documentation change

Service: aurora-dsql · 2026-02-22 · Security-related medium

File: aurora-dsql/latest/userguide/SECTION_authentication-token.md

Summary

Updated Golang SDK authentication token generation to use built-in AWS SDK v2 methods instead of manual implementation

Security assessment

The change replaces error-prone manual token generation with AWS-provided methods (GenerateDBConnectAdminAuthToken/GenerateDbConnectAuthToken), reducing risks of implementation flaws. This addresses potential security weaknesses in custom signature logic by using vetted SDK functions.

Diff

diff --git a/aurora-dsql/latest/userguide/SECTION_authentication-token.md b/aurora-dsql/latest/userguide/SECTION_authentication-token.md
index fce75a56b..4148d94e2 100644
--- a//aurora-dsql/latest/userguide/SECTION_authentication-token.md
+++ b//aurora-dsql/latest/userguide/SECTION_authentication-token.md
@@ -371 +371 @@ The following example uses the `DSQLAuthTokenGenerator` utility class to generat
-Golang
+Go
@@ -374,5 +374 @@ Golang
-###### Note
-
-The Golang SDK doesn't provide a built-in method for generating a pre-signed token. You must manually construct the signed request, as shown in the following code example.
-
-In the following code example, specify the `action` based on the PostgreSQL user:
+The AWS SDK for Go v2 provides a built-in method for generating authentication tokens in the [`github.com/aws/aws-sdk-go-v2/feature/dsql/auth`](https://github.com/aws/aws-sdk-go-v2/tree/main/feature/dsql/auth) package.
@@ -380 +376 @@ In the following code example, specify the `action` based on the PostgreSQL user
-  * If you're connecting with the `admin` role, use the `DbConnectAdmin` action.
+  * If you are connecting with the `admin` role, use `auth.GenerateDBConnectAdminAuthToken`.
@@ -382 +378 @@ In the following code example, specify the `action` based on the PostgreSQL user
-  * If you're connecting with a custom database role, use the `DbConnect` action.
+  * If you are connecting with a custom database role, use `auth.GenerateDbConnectAuthToken`.
@@ -387 +382,0 @@ In the following code example, specify the `action` based on the PostgreSQL user
-In addition to `yourClusterEndpoint` and `region`, the following example uses `action`. Specify the `action` based on the PostgreSQL user.
@@ -388,0 +384 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
+    package main
@@ -390,6 +386,3 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    func GenerateDbConnectAdminAuthToken(yourClusterEndpoint string, region string, action string) (string, error) {
-    	// Fetch credentials
-    	sess, err := session.NewSession()
-    	if err != nil {
-    		return "", err
-    	}
+    import (
+    	"context"
+    	"fmt"
@@ -397,8 +390,2 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    	creds, err := sess.Config.Credentials.Get()
-    	if err != nil {
-    		return "", err
-    	}
-    	staticCredentials := credentials.NewStaticCredentials(
-    		creds.AccessKeyID,
-    		creds.SecretAccessKey,
-    		creds.SessionToken,
+    	"github.com/aws/aws-sdk-go-v2/config"
+    	"github.com/aws/aws-sdk-go-v2/feature/dsql/auth"
@@ -407,3 +394,4 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    	// The scheme is arbitrary and is only needed because validation of the URL requires one.
-    	endpoint := "https://" + yourClusterEndpoint
-    	req, err := http.NewRequest("GET", endpoint, nil)
+    func main() {
+    	ctx := context.Background()
+    
+    	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion("region"))
@@ -411 +399 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    		return "", err
+    		panic(err)
@@ -413,3 +400,0 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    	values := req.URL.Query()
-    	values.Set("Action", action)
-    	req.URL.RawQuery = values.Encode()
@@ -417,4 +402,2 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    	signer := v4.Signer{
-    		Credentials: staticCredentials,
-    	}
-    	_, err = signer.Presign(req, nil, "dsql", region, 15*time.Minute, time.Now())
+    	// Use auth.GenerateDbConnectAuthToken for non-admin users
+    	token, err := auth.GenerateDBConnectAdminAuthToken(ctx, "yourClusterEndpoint", "region", cfg.Credentials)
@@ -422 +405 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    		return "", err
+    		panic(err)
@@ -425,3 +408 @@ In addition to `yourClusterEndpoint` and `region`, the following example uses `a
-    	url := req.URL.String()[len("https://"):]
-    
-    	return url, nil
+    	fmt.Println(token)