(bright music)
(keys clacking)
(bright upbeat music)
- Hello, I am Jeeri,
a Cloud Support Engineer
here at the AWS office in Bangalore.
Sometimes customers ask me how to authenticate
to an Amazon RDS database instance,
such as MySQL or Amazon Aurora
using an IAM user or role credentials.
I tell them there are a few things
to keep in mind when doing this.
Let me walk you through this process.
IAM Database Authentication
can be used with: MySQL 5.6, minor version 5.6.34 or higher.
MySQL 5.7, minor version 5.7.16 or higher,
Aurora MySQL, with version 1.10 or higher.
Supported for all Instance classes
except for: db.t2.small and db.m1.small for MySQL,
db.t2.small for Aurora MySQL.
You can enable IAM database authentication
on the RDS DB instance or DB cluster
by using the AWS Management Console,
AWS CLI, or the Amazon RDS API.
In this demo, we'll use the RDS console
to modify an existing MySQL database
to allow an IAM authentication.
We'll enable IAM database authentication
on a pre-existing MySQL database.
As you can see,
I am already logged into the AWS Management Console.
Navigate to the RDS console.
Select the Databases, then choose Modify.
Scroll down to the Database options.
Enable IAM DB authentication.
Then choose Apply immediately option.
When you are done,
choose Modify DB instance.
Next we'll create an IAM role
that allows Amazon RDS access from an Amazon EC2 machine.
To do so, open the IAM Console,
choose Roles from the navigation pane.
Choose Create role.
Choose AWS service and then choose EC2.
First select your use case,
choose EC2 and then choose Next Permissions.
To connect to the RDS,
we'll need to provide RDS DB Connect permission
in the policy.
Therefore we'll need to create a custom policy
by choosing the Create policy button.
And then in the JSON editor we'll provide a similar policy.
You can find this policy
in the AWS Knowledge Center article
that accompanies this video.
Know that you must edit the resource value
with the details of your database resources,
such as your DB instance identifier
and the database username that you want to connect.
When you are done, click Review policy.
Enter a role name.
And then choose Create policy.
Now we'll go back to the role page.
Now select the policy you just created
to attach to your role.
Choose Next and create role option at last.
Now it's time to attach the IAM role to the EC2 instance.
Open the Amazon EC2 console.
Choose the EC2 instance you'll use to connect to RDS
and then attach your newly created IAM role
to the EC2 instance.
When you are done,
reconnect to your EC2 instance using SSH.
Now we'll switch over to the terminal.
Next we'll log in to the DB instance
from any MySQL client
and create a database user account
that uses authentication tokens
and map them to an IAM user.
Connect to the instance
or the cluster endpoint
by running the following command.
You'll find these commands
in the AWS Knowledge Center article
that accompanies this video.
Be sure to enter the master password to log in.
Run this command to create a database user account
that uses an AWS authentication token instead of a password.
We'll create a user called Jane Doe.
Next we'll use AWS CLI
to generate an authentication token
using the IAM user name.
The AWS CLI command is rds generate-db-auth-token.
Note that this token expires in 15 minutes.
When you have this token, copy and past it aside.
Finally we'll connect to the database
using an SSL connection and then specify the IAM user
or role as the database user account
and the authentication token as a password.
Amazon RDS creates an SSL certificate
for your DB instance when the instance is created.
If you enable SSL certificate verification,
then the SSL certificate
includes the DB instance end point
as a common name for the SSL certificate
to guard against spoofing attacks.
Download the root certificate
using the wget command from the s3 location specified
at the Knowledge Center article with this video.
Connect to the DB instance
with SSL using any MySQL client.
For the host parameter,
substitute the DNS name for your DB instance.
For the SSL CA parameter,
substitute the SSL certificate file name as appropriate.
Congratulations, you can now connect
to an RDS MySQL or Aurora MySQL database
using IAM user credentials.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(bright music)