title: AWS RDS MySQL connection using IAM Role is not working
body: <p>Would like to inform upfront that I am new to AWS in general. For my project I am trying to use AWS RDS MySQL using IAM Authentication (IAM Role) from a Java application deployed on Tomcat on an EC2 instance. Before trying it from Java I am trying it from the command prompt on the EC2 instance. I am following this link to do it: </p>
  
  <p><a href="https://aws.amazon.com/premiumsupport/knowledge-center/users-connect-rds-iam/" rel="nofollow noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/users-connect-rds-iam/</a></p>
  
  <p>I have done the following so far (please pardon if I am not using correct terminologies):</p>
  
  <ul>
  <li>MySQL using AWS RDS</li>
  <li>Enabled IAM Authentication on my MySQL instance</li>
  <li>Created IAM Role for EC2</li>
  <li><p>Created an inline policy for the above IAM Role and granted required "Action". Also included the "Resources" (my database's endpoint with username), as below:</p>
  
  <pre><code>{
     "Version": "2012-10-17",
     "Statement": [
         {
             "Effect": "Allow",
             "Action": [
                 "rds-db:connect"
             ],
             "Resource": [
                 "arn:aws:rds-db:&lt;my-region&gt;:&lt;my-account-id&gt;:dbuser:&lt;my-db-resource-id&gt;/&lt;my-db-username&gt;"
             ]
         }
     ]
  }
  </code></pre></li>
  <li><p>Assigned this IAM Role to an EC2 instance I have created</p></li>
  </ul>
  
  <p>I followed everything given in the <a href="https://aws.amazon.com/premiumsupport/knowledge-center/users-connect-rds-iam/" rel="nofollow noreferrer">link at the top</a> and everything seem to work except for the last command. </p>
  
  <p>As in the link I created <strong>DB user</strong> as below:</p>
  
  <p><code>CREATE USER dev_user IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS';</code></p>
  
  <p>The last command in the link that is not working is:</p>
  
  <p><code>mysql -h {db or cluser endpoint} --ssl-ca={certificate file name with complete path} --ssl-verify-server-cert -u {dbusername2} -p"{authenticationtoken}" --enable-cleartext-plugin</code> </p>
  
  <p>Every time I run this command it asks for the password and then I am getting an error. I am at a loss on how to resolve it.</p>
  
  <p>In the above mysql command if I pass my <strong>master user-id</strong> (I created it as 'admin') and enter it's password I get an error like this:</p>
  
  <pre><code>[ec2-user@ip-xxx-xx-xx-16 ~]$ mysql -h &lt;endpoint of my RDS DB instance&gt; --ssl-ca=rds-combined-ca-bundle.pem --ssl-verify-server-cert -u admin -p 'aws rds generate-db-auth-token --hostname &lt;endpoint of my RDS DB instance&gt; --port 3306 --username dev_user' --enable-cleartext-plugin
  </code></pre>
  
  <p><strong>Enter password: 
  ERROR 1059 (42000): Identifier name 'aws rds generate-db-auth-token --hostname  --port' is too long</strong></p>
  
  <p>And if in the same command I provide the above created DB user (dev_user). I get the following error if provide "dev_user" as user in the command and whether I enter a password or not. <strong>[In this case, the above link did not set a password so what should I do when it asks to enter the password?]</strong>:</p>
  
  <pre><code>[ec2-user@ip-xxx-xx-xx-16 ~]$ mysql -h &lt;endpoint of my RDS DB instance&gt; --ssl-ca=rds-combined-ca-bundle.pem --ssl-verify-server-cert -u dev_user -p 'aws rds generate-db-auth-token --hostname &lt;endpoint of my RDS DB instance&gt; --port 3306 --username dev_user' --enable-cleartext-plugin
  </code></pre>
  
  <p><strong>Enter password: 
  ERROR 1045 (28000): Access denied for user 'dev_user'@'xxx.xx.xx.16' (using password: YES)</strong></p>
  
  <p>I get the same "Access denied..." error when I enter "admin" in both places in the command above.</p>
  
  <p>Any help will be highly appreciated.</p>
  
  <p>Thank you.</p>