AWS Lambda and MySQL IAM Authentication in Go

Recently I’ve tried to write a lambda function in Go, which connects to MySQL database on RDS instance and use IAM Authentication instead of “traditional” approach with passwords (which I think is an anti-pattern in cloud environments).

I’ve spent way too much time to solve the problem, but the documentation and examples on the Internet are lacking and wrong in some places… It’s time to document it right!

To make the above described scenario working we have to do a copule of things:

Create user on MySQL instance

Connect to the instance and issue the following commands:

mysql> CREATE USER '<DB_USER>' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS';
mysql> GRANT ALL PRIVILEGES ON <DB_NAME>.* TO ''<DB_USERNAME>'@'%';
mysql> FLUSH PRIVILEGES;

Make/modify IAM role for lambda

Our lambda needs the following policy to be able to connect to MySQL instance:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds-db:connect"
      ],
      "Resource": [
        "arn:aws:rds-db:REGION:AWS_ACCOUNT_NUMBER:dbuser:RESOURCE_ID/DB_USER"
      ]
    }
  ]
}

Of course you need to replace values in Resource to your account. Make sure that DB_USER is the same as the name you have created in Create user on MySQL instance section above.

If you want to quickly find resource id of the database instance, just issue:

aws rds describe-db-instances --query "DBInstances[*].[DBInstanceIdentifier,DbiResourceId]"

Connect from Go

I’ll skip all “lambda stuff”, validation of parameters and error handling and just paste “the meat” – code to connect to DB:

awsCred := credentials.NewEnvCredentials() // lambda gets credentials from ENV variables
dbHost := os.Getenv("DB_HOST")
dbUser := os.Getenv("DB_USER")
region := os.Getenv("AWS_DEFAULT_REGION") // we assume that db is in the same region

token, err := rdsutils.BuildAuthToken(fmt.Sprintf("%s:%d", dbHost, 3306), region, dbUser, awsCred) // specifying port is very important as it cannot authenticate without that and docs say nothing about it

dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s?tls=true&allowCleartextPasswords=1", dbUser, token, dbHost, dbName) // cleartext passwords are required so mysql can validate token

db, err := sql.Open("mysql", dsn)
defer db.Close()

// here comes your query to database

And here we are – we can connect from lambda to MySQL without any passwords :)