AWS.RDS.signer + TypeORM

[cdavis21]

Hi,

I was wondering if you could provide some guidance. I'm using TypeORM and I'm trying to connect to an RDS Aurora MySQL instance using IAM authentication. I'm not sure if I have the correct syntax in the authPlugins object. I'm getting the following error:

Access denied for user 'xxxxxxxxxx'@'yyyyyyyyyyy' (using password: YES)

Aurora MySQL engine is 5.7.mysql_aurora.2.04.5

    const signer = new AWS.RDS.Signer({
      region,
      username,
      hostname,
      port: 3306
    });

createConnection({
      host,
      username,
      database,
      entities: [..., ....],
      ssl: 'Amazon RDS',
      extra: {
        authPlugins: {
          mysql_clear_password: () => () =>
            signer.getAuthToken({
              username,
              region,
              hostname,
              port: 3306
            })
        }
      }
    });

[sidorares]

authPlugins should be part of the main config and not under extra field:

const signer = new AWS.RDS.Signer({
  region,
  username,
  hostname,
  port: 3306
});

const rdsSignerAuth = () => () => {
  return signer.getAuthToken({
    username,
    region,
    hostname,
    port: 3306
  });
};

createConnection({
  host,
  username,
  database,
  ssl: "Amazon RDS",
  authPlugins: {
    mysql_clear_password: rdsSignerAuth
  }
});

[cdavis21]

Thank you for your quick response. When I try what you have suggested above I receive:

Error: Server requests authentication using unknown plugin mysql_clear_password. See TODO: add plugins doco here on how to configure or author authentication plugins.

When I try the below I receive the Access denied for user 'xxxxxxxxxx'@'yyyyyyyyyyy' (using password: YES) still.

I'm thinking because I'm using TypeORM and not the mysql client directly, the syntax differs? Here is another article using the deprecated authSwitchHandler method with TypeORM https://tech.bitbank.cc/typeorm-iam-rds/ (code in english, article in Japanese)

createConnection({
      host,
      username,
      database,
      entities: [..., ....],
      ssl: 'Amazon RDS',
      extra: {
        authPlugins: {
          mysql_clear_password: rdsSignerAuth
        }
      }
    });

[sidorares]

Oh, sorry I didn't realise it's a config for use with typeORM. I'll check their codebase for how driver is used

[BlackTafita]

I have the same issue. Any updates?

[buildgreatthings]

I also have the same issue!

[qvanegeren]

Did anyone ever figure this out?

[buildgreatthings]

I moved to sequelize where I could pass mysql2 options directly in .

[mtalbert]

I was able to get it working with the following in my ormconfig.ts

const signer = new Signer({
   region: process.env.AWS_REGION,
   hostname: secret!.host,
   port: secret!.port,
   username: secret!.username
});

module.exports = {
   name: 'default',
   type: "mysql",
   host: secret!.host,
   port: secret!.port,
   username: secret!.username,
   password: secret!.password,
   database: secret!.dbname,
   timezone: "Z",
   logging: false,
   synchronize: false,
   entities: [
      '/opt/nodejs/schemas/**/*.schema.js'
   ],
   migrations: [
      "*-*.ts"
   ],
   ssl: "Amazon RDS",
   extra: {
      authPlugins: { mysql_clear_password: () => () => signer.getAuthToken({}) }
   }
} as ConnectionOptions;

[antoniot13]

Any updates on this ?