SCS-C02 Question 283
Select 3Your company uses an Amazon RDS MySQL database instance to store sensitive customer data. To improve security, the company decides to enforce authentication using IAM database authentication. After enabling IAM database authentication on the RDS instance, a developer reports that they are unable to connect to the database using their IAM credentials. Which of the following actions should you take to troubleshoot and resolve the issue?
- A
Ensure the RDS instance is using an SSL connection.
- B
Verify that the developer's IAM user has the 'rds-db:connect' permission for the RDS instance.
- C
Check if the database user matching the IAM user's name exists in the MySQL database.
- D
Verify that the RDS instance is running in a public subnet with an associated internet gateway.
- E
Ensure the developer's IAM user is also added to a group with the 'AmazonRDSFullAccess' policy attached.
Show answer and explanation
Correct answers: A, B, C
Explanation
When using IAM database authentication for an RDS MySQL database, there are several prerequisites to ensure a successful connection. The RDS instance must enforce SSL connections for secure communication. Additionally, the IAM user must have the 'rds-db:connect' permission specific to the RDS instance. Finally, the MySQL database must have a user that matches the IAM user's name to complete the authentication process. Network configuration and general RDS management policies are unrelated to this authentication mechanism.
- A. Correct.
Correct: IAM database authentication requires an SSL connection to the RDS instance for secure communication. Without SSL, the authentication will fail.
- B. Correct.
Correct: The 'rds-db:connect' permission is required to allow the IAM user to authenticate and connect to the RDS database instance.
- C. Correct.
Correct: A corresponding database user must exist in the MySQL database with the same name as the IAM user for the connection to succeed.
- D. Incorrect.
Incorrect: While public subnets and internet gateways are relevant to network connectivity, they are unrelated to IAM database authentication and do not resolve the described issue.
- E. Incorrect.
Incorrect: The 'AmazonRDSFullAccess' policy is used for managing RDS resources, but it is not required for IAM database authentication.