title: RDS Postgres DB IAM generate_db_auth_token not working
body: <p>In <strong>AWS</strong> I have an <strong>RDS Postgres database</strong>. The database has users that can connect via <strong>IAM</strong> (they have the <strong>IAM_USER</strong> role). The connection is achieved programmatically via <strong>Python</strong> and <strong>Boto3</strong>, e.g.:</p>
  
  <p><strong>RDS Client setup</strong></p>
  
  <pre><code>self.rds = boto3.client(
      'rds',
      region_name = rds_region,
      aws_access_key_id = aws_access_key_id,
      aws_secret_access_key = aws_secret_access_key,
  )
  
  </code></pre>
  
  <p><strong>Generating the token</strong></p>
  
  <pre><code>return self.rds.generate_db_auth_token(
      self.db_hostname,
      self.port,
      self.db_username,
      Region=self.region
  )
  </code></pre>
  
  <p>A valid token is generated that enables a Postgres login when I use the AWS keys of an IAM user that pretty much has access to everything in AWS.</p>
  
  <p>However when I use the AWS keys of a user that only has <strong>AmazonRDSFullAccess</strong> and <strong>AmazonRDSDataFullAccess</strong> a token is generated which looks similar to a valid one but is not accepted as a password when I attempt to login to Postgres, e.g.:</p>
  
  <pre><code>OperationalError: (psycopg2.OperationalError) FATAL:  PAM authentication failed for user "test_iam_user"
  </code></pre>
  
  <p>This user can access all my RDS resources correctly as far as I can tell, it just doesn't generate a valid token.</p>
  
  <p>I'd be grateful if anyone could tell what is the missing permission(s) and/or what I'm doing wrong.</p>
  
  <p>It would also be good to know the best way to troubleshoot permission problems like these in AWS to find the specific permission that's preventing access.</p>
  
  <p>Cheers!!!</p>