RDS generate-db-auth-token can generated expired token if your main token has expired

[pserrano]

Hello everyone,

I will try to expose my case here. I usually login to a few accounts with a expired time, like 4 hours each main token. When this time passed in your session, you can generate a "expired" token to login in RDS IAM when you are executing this command:

  aws rds generate-db-auth-token \
   --hostname the-rds-server \
   --port 3306 \
   --region eu-central-1 \
   --username username

And this command generates the password/token but isn't valid because your session has gone.

Is there any possibility to avoid this or do an error message?

I think it's very useful to get a error to don't waste a time looking for the error. In another services you get a error like:

aws s3api get-bucket-policy --bucket demo-bucked
An error occurred (ExpiredToken) when calling the GetBucketPolicy operation: The provided token has expired.

I hope that you can fix it. Thanks

[joguSD]

While I could definitely see how this could be useful, I don't know if there's a way for us to know if an arbitrary set of credentials has expired or not without making an API call. Perhaps we could do an STS GetCallerIdentity call to sanity check the credentials before using them to generate this but it would have to be behind a flag / options for sure...

How are you getting these temporary credentials? Perhaps using a different credential provider you could avoid using expired credentials?

Alternatively, you could just have a script do an aws sts get-caller-identity call before the token generation.

[pserrano]

Hi, thanks for your reply.

I am using onelogin with saml config to login into aws, and this generate tokens for 4 hours. Anyway i could do a workaround to my script, but sounds strange that aws s3 have this kind of control and aws rds doesn't. i think this could be useful like aws s3 ExpiredToken control.

[pserrano]

Any ETA?

[github-actions]

Greetings! It looks like this issue hasn’t been active in longer than one year. We encourage you to check if this is still an issue in the latest release. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or upvote with a reaction on the initial post to prevent automatic closure. If the issue is already closed, please feel free to open a new one.