title: 400 bad request when attempting connection to AWS Neptune with IAM enabled
body: <p>I am unable to connect to neptune instance that has IAM enabled. I have followed the AWS documentation (corrected a few of my silly errors on the way) but without luck.</p>
  
  <p>When I connect via my Java application using the SigV4Signer and when I use the gremlin console, I get a 400 bad request websocket error.  </p>
  
  <pre><code>o.a.t.g.d.Handler$GremlinResponseHandler : Could not process the response
  
  io.netty.handler.codec.http.websocketx.WebSocketHandshakeException: Invalid handshake response getStatus: 400 Bad Request
      at io.netty.handler.codec.http.websocketx.WebSocketClientHandshaker13.verify(WebSocketClientHandshaker13.java:267)
      at io.netty.handler.codec.http.websocketx.WebSocketClientHandshaker.finishHandshake(WebSocketClientHandshaker.java:302)
      at org.apache.tinkerpop.gremlin.driver.handler.WebSocketClientHandler.channelRead0(WebSocketClientHandler.java:69)
  </code></pre>
  
  <p>When I run <code>com.amazon.neptune.gremlin.driver.example.NeptuneGremlinSigV4Example</code> (from my machine over port-forwarding AND from the EC2 jumphost) I get: </p>
  
  <p><code>java.util.concurrent.TimeoutException: Timed out while waiting for an available host - check the client configuration and connectivity to the server if this message persists</code></p>
  
  <p>I am able to connect to my neptune instance using the older deprecated certificate mechanism.  I am using a jumphost ec2 instance and port-forwarding.</p>
  
  <p>I believe that the SigV4 aspect is working as in the neptune audit logs I can see attempts to connect with the aws_access_key:</p>
  
  <p><code>1584098990319, &lt;jumphost_ip&gt;:47390, &lt;db_instance_ip&gt;:8182, HTTP_GET, [unknown], [unknown], "HttpObjectAggregator$AggregatedFullHttpRequest(decodeResult: success, version: HTTP/1.1, content: CompositeByteBuf(ridx: 0, widx: 0, cap: 0, components=0)) GET /gremlin HTTP/1.1 upgrade: websocket connection: upgrade sec-websocket-key: g44zxck9hTI9cZrq05V19Q== sec-websocket-origin: http://localhost:8182 sec-websocket-version: 13 Host: localhost:8182 X-Amz-Date: 20200313T112950Z Authorization: AWS4-HMAC-SHA256 Credential=&lt;my_access_key&gt;/20200313/eu-west-2/neptune-db/aws4_request, SignedHeaders=host;sec-websocket-key;sec-websocket-origin;sec-websocket-version;upgrade;x-amz-date, Signature=&lt;the_signature&gt; content-length: 0", /gremlin</code></p>
  
  <p>But when I look </p>
  
  <p>This is the policy that I created:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "neptune-db:*"
              ],
              "Resource": [
                  "arn:aws:neptune-db:eu-west-2:&lt;my_aws_account&gt;:*/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>I have previously tried with a policy that references my cluster resource id.
  I created a new api user with this policy attached as its only permission.  (I've tried this twice).</p>
  
  <p>IAM is showing my that the graph-user I created has not successfully logged in (duh).</p>
  
  <p>Seems that the issue is with the IAM set-up somewhere along the line.  Is it possible to get more information out of AWS with regards to why the connection attempt is failing?</p>
  
  <p>I am using the most recent release of Neptune and the 3.4.3 Gremlin Driver and console.  I am using Java 8 when running the <code>NeptuneGremlinSigV4Example</code> and building the libraries to deploy to the console.</p>
  
  <p>thanks</p>