title: Connecting to Amazon Aurora using SQLAlchemy
body: <p>I am trying to connect to Amazon Aurora with SQLAlchemy using an SSL connection, specifying the IAM role as the database user account and the authentication token as the password, as described here in [AWS docs] 
  (<a href="http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html#UsingWithRDS.IAMDBAuth.Connecting" rel="nofollow noreferrer">http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html#UsingWithRDS.IAMDBAuth.Connecting</a>)</p>
  
  <p>These are the steps I followed.</p>
  
  <pre><code>wget https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem
  
  export LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1
  
  aws rds generate-db-auth-token --hostname 'datadbcluster-1.cluster-xxxxxxxxxxxx.us-west-2.rds.amazonaws.com' --port 3306 --username dt_analyst --region us-west-2 &gt; /home/ubuntu/dt_analyst.pem
  
  mysql -h datadbinstance2nd. xxxxxxxxxxxx.us-west-2.rds.amazonaws.com--ssl-ca /home/ubuntu/rds-combined-ca-bundle.pem -u dt_analyst --ssl-verify-server-cert --enable-cleartext-plugin -p'&lt;token&gt;'
  </code></pre>
  
  <p>I verified that I can connect over SSL using the mysql client. </p>
  
  <p>But I want to connect using sqlalchemy and not the mysql client.  The following code is compiled from a dozen pieces of advice found on the internet but only yields the following error. </p>
  
  <p>‘sqlalchemy.exc.OperationalError: (_mysql_exceptions.OperationalError) (1045, "Access denied for user…”)’</p>
  
  <p>My code is as follows.</p>
  
  <pre><code>import boto3
  
  client = boto3.client('rds', region_name='us-west-2')
  
  dialect='mysql'
  user = ‘dt_analyst’
  host = 'datadbcluster-1.cluster-xxxxxxxxxxxx.us-west-2.rds.amazonaws.com'
  port = 3306
  data = ‘datadb’
  region='us-west-2'
  
  token = client.generate_db_auth_token(host,port,user,region)
  host1 = 'datadbinstance2nd. xxxxxxxxxxxx.us-west-2.rds.amazonaws.com'
  conn_str = '%s://%s:%s@%s:%d/%s'%(dialect,user,token,host1,port,data)
  conn_str += '?ssl_key=%s'%token
  conn_str += '&amp;ssl_cert=’/home/ubuntu/rds-combined-ca-bundle.pem'
  
  ssl_args = {
      'ssl': {
          'ca_cert': '/home/ubuntu/rds-combined-ca-bundle.pem',
          'sslmode': 'require',
          'verify_ssl_cert': True
      }
  }
  
  engine = create_engine(conn_str,connect_args=ssl_args, echo=True)
  </code></pre>