title: Amazon RDS IAM PAM Auth failed
body: <p>I enabled IAM Auth on my Postgresql, and my user <code>myAWSusername</code> has RDSFullAccess</p>
  
  <pre><code>export RDSHOST="MYRDSHOSTNAME.us-east-2.rds.amazonaws.com"
  export PGPASSWORD="$(aws rds generate-db-auth-token --hostname $RDSHOST --port 5432 --region us-east-2 --username myAWSusername(not db_userx) )"
  psql "host=$RDSHOST port=5432 sslmode=verify-full sslrootcert=./rds-combined-ca-bundle.pem dbname=busscanner user=db_userx"
  </code></pre>
  
  <p>and I get:</p>
  
  <pre><code>psql: FATAL:  PAM authentication failed for user "db_userx"
  </code></pre>
  
  <p>This is how created my db_userx</p>
  
  <pre><code>CREATE USER db_userx WITH LOGIN; 
  GRANT rds_iam TO db_userx;
  </code></pre>
  
  <p>output of <code>\du</code></p>
  
  <pre><code>     Role name     |                         Attributes                         |                   Member of                    
  -------------------+------------------------------------------------------------+------------------------------------------------
   db_userx          |                                                            | {rds_iam}
   postgres_ro       |                                                            | {postgres_ro_group}
   postgres_ro_group | Cannot login                                               | {}
   rds_iam           | Cannot login                                               | {}
   rds_replication   | Cannot login                                               | {}
   rds_superuser     | Cannot login                                               | {pg_monitor,pg_signal_backend,rds_replication}
   rdsadmin          | Superuser, Create role, Create DB, Replication, Bypass RLS+| {}
                     | Password valid until infinity                              | 
   rdsrepladmin      | No inheritance, Cannot login, Replication                  | {}
   read_only_user    | Password valid until infinity                              | {}
  </code></pre>
  
  <p>is cannot login correct for <code>rds_iam</code>?</p>
  
  <p>This is the policy I attached to my user:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "rds-db:connect"
              ],
              "Resource": [
                  "arn:aws:rds-db:us-east-2:MYAWSROOTACCOUNTID:dbuser:*/db_userx"
              ]
          }
      ]
  }
  </code></pre>