IAM authentication - RDS MYSQL - EKS

Question

Hi, 
I am trying to establish a connection from the EKS cluster to an RDS MYSQL instance.
For business needs, the cluster is located in one account and the database in another account. The database has been deployed on a shared subnet. With user&password authentication I have already managed to connect, but I need to use [IAM authentication ](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).

I have followed this steps:

* Activate IAM DB authentication on the RDS DB instance.
* Create a [database user account ](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html) that uses an AWS authentication token. 
* Add an[ IAM policy](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html) that maps the database user to the IAM role. && Create an IAM role that allows Amazon RDS access.
* Attach the IAM role to pod.
* Connect to the RDS DB instance using IAM role credentials and the authentication token. [(Golang code)](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.Go.html)

I receive the token correctly but I am getting this error:

*"tls failed to verify certificate X.509: certificate Signed by Unknown Authority"*

I have seen that I may be missing an additional step according to [ this guide](https://repost.aws/knowledge-center/users-connect-rds-iam). But it seems strange to me that the code that I indicated above does not refer to the certificate.

* Download the SSL root certificate file or certificate bundle file. (TODO)

Is this step really necessary if I am using EKS?

**NOTES:**
We have tested the connection without and with, (ALTER USER {dbusername} REQUIRE SSL)

Accepted Answer

Hello,

Certificate should be imported. Please verify if certificate was imported to the keystore correctly.

```
keytool -list -v -keystore clientkeystore.jks
```

Output:

```
rds-root,date, trustedCertEntry, 
Certificate fingerprint (SHA1): D4:0D:DB:29:E3:75:0D:FF:A6:71:C3:14:0B:BF:5F:47:8D:1C:80:96
# This fingerprint should match the output from the below command
openssl x509 -fingerprint -in rds-ca-2019-root.pem -noout
```

Reference 3rd party document: https://medium.com/techcret/setting-up-an-ssl-certificate-with-aws-rds-cf809b794a73

Answer

Hello,
It also applies to Go? The library is going to detect automatically where the cert is install?

IAM authentication - RDS MYSQL - EKS

Relevant content