RDS-Signer token is not getting generated

[anitatailor]

Hi All,

I am generating token using RDS signer in my application running on EC2. When I used AWS CLI command to generate token ex: aws rds generate-db-auth-token --hostname ...." I am able to generate valid token on same EC2 server. Then I created a independent JS file and used

const signer = new Signer({
hostname: "xxx",
port: 3306,
username: "XXX",
region: "ap-south-1",
});

const token = await signer.getAuthToken();

This also gave me valid token.

I included same code in my application but from application token it generated does not have X-Amz-Security-Token part hence overall token is invalid. As same code is working independently something in application is causing this but there is no error being thrown by aws-sdk to debug this.

There are not much logs in following code. Any direction to debug this?

https://github.com/aws/aws-sdk-js-v3/blob/56667d32/packages/rds-signer/src/Signer.ts#L65

https://github.com/aws/aws-sdk-js-v3/blob/56667d32e95d611b5035b4adecf0a7612129c5b9/packages/signature-v4/src/SignatureV4.ts

Regards
Anita

[anitatailor]

This is solved now. I added logs in aws-sdk and learned that credential object did not have sessionToken. As this object was loaded from runtime config, i checked my runtime config which has aws key. So after removing that, code has used iam role as credential and worked as expected. I am not too sure if there should be check in validateResolvedCredentials function for missing sessionToken in below file

https://github.com/aws/aws-sdk-js-v3/blob/56667d32e95d611b5035b4adecf0a7612129c5b9/packages/signature-v4/src/SignatureV4.ts

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.