IAM

MFA

Enable MFA on AWS

Install a virtual multi-factor authentication (MFA) application, such as Google Authenticator.
Sign in to the AWS Management Console and select your user name, then Security credentials.
Under Multi-factor authentication (MFA), choose Assign MFA device.
Choose Virtual MFA device, then select Continue.
Scan the QR code with the MFA application. Enter two consecutive six-digit codes when prompted, then choose Assign MFA.
Attach the self-management policy if users must manage their own MFA devices.

Remove MFA

Deactivate MFA before deleting its virtual device:

aws iam deactivate-mfa-device --user-name <username> --serial-number arn:aws:iam::<account-id>:mfa/<username>
aws iam delete-virtual-mfa-device --serial-number arn:aws:iam::<account-id>:mfa/<username>

IAM Database Authentication for MySQL

IAM database authentication lets a database user connect to Amazon RDS with a short-lived authentication token instead of a stored database password.

Activate IAM DB authentication

Enable IAM database authentication on the RDS instance or cluster. Confirm that the database engine and version support it before enabling the setting.

Create a database user account that uses an AWS authentication token

Connect to the DB instance or cluster endpoint with master credentials, then create the database user:

CREATE USER {dbusername} IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS';

The database user has no privileges by default. To require TLS and grant the minimum privileges the application needs, run commands such as:

ALTER USER {dbusername} REQUIRE SSL;
GRANT SELECT, INSERT, UPDATE, DELETE, ALTER ON *.* TO '{dbusername}'@'%';

Add an IAM policy

Create an IAM policy that allows rds-db:connect only for the required database user and resource. Replace the example region, account ID, resource identifier, and user name before use.

{
    "Version": "2012-10-17",
    "Statement": [
       {
          "Effect": "Allow",
          "Action": [
              "rds-db:connect"
          ],
          "Resource": [
              "arn:aws:rds-db:ap-southeast-1:111111111111:dbuser:cluster-XXXXXXXXXXXX/*"
          ]
       }
    ]
}

Connect to the RDS DB using IAM role credentials

Download SSL certificates

Download the regional AWS RDS CA bundle:

wget https://truststore.pki.rds.amazonaws.com/ap-southeast-1/ap-southeast-1-bundle.pem

Generate an authentication token and connect

Authentication tokens are valid for 15 minutes. Generate one immediately before connecting:

RDSHOST="myrds.ap-southeast-1.rds.amazonaws.com"
DBUSERNAME={dbusername}
TOKEN="$(aws rds generate-db-auth-token --hostname $RDSHOST --port 3306 --region ap-southeast-1 --username $DBUSERNAME)"
mysql --host=$RDSHOST --port=3306 --ssl-ca=/fullpathtopem/ap-southeast-1-bundle.pem --ssl-mode=VERIFY_CA --enable-cleartext-plugin --user=$DBUSERNAME --password=$TOKEN

Notes

Verify client-specific TLS and IAM-authentication settings when using a client other than the MySQL CLI.
The database user name does not need to match the AWS user or role name.
Create a separate database user for IAM authentication; existing password users can continue to use password authentication.
Connect using the RDS endpoint. An alternative DNS name will not work for token validation.
Consider IAM database authentication for workloads that create fewer than 200 new connections per second and where avoiding stored database passwords is valuable.

IAM

MFA