# IAM authentication

Authenticate to **MySQL**, **PostgreSQL**, **Aurora MySQL**, **Aurora PostgreSQL**, and **MariaDB** RDS instances using [AWS Identity and Access Management (IAM) database authentication](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).

Using IAM for authenticating an RDS instance offers the following benefits:

* Network traffic to and from the database is encrypted using Secure Socket Layer (SSL) or Transport Layer Security (TLS).
* Centrally manage access to your database resources, instead of managing access individually for each DB instance.
* For applications running on Amazon EC2 hosts, you can use profile credentials specific to your EC2 instance to access your database, instead of using a password, for greater security.

## Configuring RDS IAM Authentication in DuploCloud

Use the System Config tab to enable IAM authentication before enabling it for a specific RDS instance.

1. In the DuploCloud Portal, navigate to **Administrator** -> **System Settings**.
2. Click the **System Config** tab. The **Add Config** pane displays.
3. From the **Config Type** list box, set **Flags**.
4. From the **Key** list box, select **Enable RDS IAM auth**.
5. From the **Value** list box, select **True**.
6. Click **Submit**. The configuration is displayed in the **System Config** tab.

<div align="left"><figure><img src="https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Fjvx3QoCZDgWp1IQdBD23%2Fiam1.png?alt=media&#x26;token=09ab0738-2af7-4e3e-bec0-b9fa02d26149" alt=""><figcaption><p><strong>Add Config</strong> pane with the <strong>Enable RDS IAM auth</strong> <strong>Key</strong></p></figcaption></figure></div>

<div align="left"><figure><img src="https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2FuqTPAg6wPOZQGARxVoPx%2Fimage%20(1).png?alt=media&#x26;token=69b121d1-2ab8-47de-b2ce-88a9fb62fa16" alt=""><figcaption><p><strong>System Config</strong> tab with <strong>EnableRdsIamAuth</strong> <strong>Key</strong> with <strong>Value</strong> of <strong>true</strong></p></figcaption></figure></div>

## Enabling IAM for an RDS instance

You can also enable IAM for any MySQL, PostgreSQL, and MariaDB instance during RDS creation or by updating the **RDS Settings** after RDS creation.

### Enabling IAM when creating an RDS

Select the **Enable IAM auth** option when you [create an RDS database](https://docs.duplocloud.com/docs/automation-platform/overview/aws-services/database/rds-database/..#id-0-toc-title).

<figure><img src="https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2FoFWupnBFM86Q8p3u41BT%2Fscreenshot-nimbusweb.me-2024.02.19-17_20_02.png?alt=media&#x26;token=ec3ca5d3-793f-4e29-8a99-ca88b23b6fba" alt=""><figcaption><p><strong>Create a RDS</strong> page with <strong>Enable IAM Auth</strong> option highlighted</p></figcaption></figure>

### Enabling IAM after RDS creation

1. In the DuploCloud Portal, navigate to **Cloud Services** -> **Database**.
2. In the **RDS** tab, select the database for which you want to enable IAM.
3. Click the **Actions** menu and select **RDS Settings** -> **Update IAM Auth**. The **Update IAM Auth** pane displays.<br>

   <div align="left"><figure><img src="https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2FgwUBxU2hvV9n6AwdXvtK%2FIAM5.png?alt=media&#x26;token=3261bef1-67a2-4624-b083-29370aacf78e" alt=""><figcaption><p><strong>Actions</strong> menu in <strong>RDS</strong> tab with <strong>RDS Settings</strong></p></figcaption></figure></div>

   <div align="left"><figure><img src="https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2F3BxcYBeTyzPRoUueBmLr%2FIAM4.png?alt=media&#x26;token=8789760e-9e98-4c0a-91cb-c8276f2b07a9" alt=""><figcaption><p><strong>Update IAM Auth</strong> pane</p></figcaption></figure></div>
4. Select **Enable IAM Auth**.
5. Click **Update**.

## Getting an Authentication Token

To download a token which you can use for IAM authentication:

1. In the DuploCloud Portal, navigate to **Cloud Services** -> **Database**.
2. In the **RDS** tab, select the database for which you want to enable IAM.
3. Click the **Actions** menu and select **View** -> **Get DB Auth Token**. The **RDS Credentials window** displays.

   <div align="left"><figure><img src="https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2Frxu7zIbIF5lhpGUxLiOM%2FIAM6.png?alt=media&#x26;token=ab6b618b-1295-44f9-bb92-616598058b65" alt=""><figcaption><p><strong>Actions</strong> menu in <strong>RDS</strong> tab with <strong>View</strong> -> <strong>Get DB Auto Token</strong> option</p></figcaption></figure></div>
4. In the **RDS Credentials** window, click the Copy Icon ( <img src="https://2471407984-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F68cb0s9ce5UIUKWPuYs8%2Fuploads%2FWeIdo7gyB77M5reNRKG1%2Fcopy_icon.png?alt=media&#x26;token=903e9bf7-a294-41ae-97e9-dcb22d848041" alt="" data-size="line"> ) to copy the **Endpoint**, **Username**, and **Password** to your clipboard.
5. Click **Close** to dismiss the window.

{% hint style="danger" %}
**PostgreSQL / Aurora PostgreSQL**

To log in using an IAM token, the PostgreSQL database user must explicitly have IAM permission. Without this, the login will fail with `FATAL: password authentication failed`. Run the following commands to allow the `duplo_jit` to successfully log in using IAM tokens.

1. Log in to the database using the **Master Username**.
2. Run the following SQL commands:

```sql
CREATE USER "duplo_jit";
GRANT rds_iam TO "duplo_jit";
```

{% endhint %}