title: Why can I not connect to an RDS Aurora DB via proxy?
body: <p>I setup a Postgresql Aurora DB and a Proxy via Terraform (code below), which is apparently running fine. But for some reason I can not connect to the DB through the proxy. The proxy claims that there are lacking credentials for the role, but if I connect directly to the DB everything is fine and the credentials are working.</p>
  <p>I tried this from a VPN and directly from an EC2 instance:</p>
  <pre><code>$ psql -h [aurora-endpoint] -p 5432 -d [database] -U admin
  Password for user admin: 
  psql (13.3, server 11.9)
  SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
  Type &quot;help&quot; for help.
  
  [database]=&gt; 
  </code></pre>
  <p>This works, but when I try to connect to the proxy:</p>
  <pre><code>$ psql -h [proxy-endpoint] -p 5432 -d [database] -U admin
  psql: error: FATAL:  This RDS proxy has no credentials for the role cellwerkadmin. Check the credentials for this role and try again.
  FATAL:  This RDS proxy has no credentials for the role cellwerkadmin. Check the credentials for this role and try again.
  
  </code></pre>
  <p>Does anyone have an idea what the problem is here?</p>
  <p>Terraform code:</p>
  <pre><code># Subnet group for Aurora
  resource &quot;aws_db_subnet_group&quot; &quot;aurora_sg_group&quot; {
    name       = &quot;aurora&quot;
    subnet_ids = var.private_subnets_ids
  
    tags = {
      Name = &quot;Subnet group for the Aurora DB&quot;
    }
  }
  
  # RDS cluster parameter group for Aurora
  resource &quot;aws_rds_cluster_parameter_group&quot; &quot;aurora_eu_central_1&quot; {
    name_prefix = &quot;eu-central-1-aurora-postgres11-cluster-parameter-group&quot;
    family      = &quot;aurora-postgresql11&quot;
    description = &quot;eu-central-1-aurora-postgres11-cluster-parameter-group&quot;
  }
  
  # Aurora RDS postgresql
  
  module &quot;aurora&quot; {
    source = &quot;../modules/terraform-aws-rds-aurora/&quot;
  
    name                   = &quot;cellwerk-aurora&quot;
    username               = data.aws_ssm_parameter.db_username.value
    create_random_password = false
    password               = data.aws_ssm_parameter.db_password.value
    engine                 = &quot;aurora-postgresql&quot;
    engine_version         = &quot;11.9&quot;
    instance_type          = &quot;db.r6g.large&quot;
    instance_type_replica  = &quot;db.t3.medium&quot;
  
    vpc_id                = module.link_delivery_eu_central_1.vpc_id
    db_subnet_group_name  = &quot;aurora&quot;
    create_security_group = false
    allowed_cidr_blocks   = concat(... subnets )
    vpc_security_group_ids = [aws_security_group.rds.id]
  
    replica_count         = 1
    replica_scale_enabled = true
    replica_scale_min     = 1
    replica_scale_max     = 5
  
    monitoring_interval           = 60
    iam_role_name                 = &quot;aurora-eu-central-1-enhanced-monitoring&quot;
    iam_role_use_name_prefix      = false
    iam_role_description          = &quot;eu-central-1 Aurora RDS enhanced monitoring IAM role&quot;
    iam_role_path                 = &quot;/autoscaling/&quot;
    iam_role_max_session_duration = 7200
  
    apply_immediately   = true
    skip_final_snapshot = true
  
    db_parameter_group_name         = &quot;aurora-postgresl11&quot;
    db_cluster_parameter_group_name = aws_rds_cluster_parameter_group.aurora_eu_central_1.name  
    enabled_cloudwatch_logs_exports = [&quot;postgresql&quot;]
  
    tags = {
      Owner       = &quot;company&quot;
      Environment = &quot;production&quot;
    }
  }
  
  # Proxy for Aurora
  
  resource &quot;aws_iam_role&quot; &quot;iam_proxy_eu_central_1&quot; {
    name = &quot;iam_proxy_eu_central_1&quot;
  
    assume_role_policy = &lt;&lt;EOF
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;rds.amazonaws.com&quot;
        },
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Sid&quot;: &quot;&quot;
      }
    ]
  }
  EOF
  }
  
  resource &quot;aws_iam_policy&quot; &quot;proxy_eu_central_1&quot; {
    name        = &quot;proxy-eu-central-1&quot;
    path        = &quot;/&quot;
    description = &quot;IAM policy for logging into the aurora db&quot;
  
    policy = &lt;&lt;EOF
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Action&quot;: [
                  &quot;secretsmanager:GetResourcePolicy&quot;,
                  &quot;secretsmanager:GetSecretValue&quot;,
                  &quot;secretsmanager:DescribeSecret&quot;,
                  &quot;secretsmanager:ListSecretVersionIds&quot;
        ],
        &quot;Resource&quot;: &quot;arn:aws:secretsmanager:eu-central-1:[account]:secret:[company]/aurora-Pa40We&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;
      }
    ]
  }
  EOF
  }
  
  resource &quot;aws_db_proxy&quot; &quot;proxy_eu_central_1&quot; {
    name                   = &quot;proxy-eu-central-1&quot;
    debug_logging          = true
    engine_family          = &quot;POSTGRESQL&quot;
    idle_client_timeout    = 1800
    require_tls            = false
    role_arn               = aws_iam_role.iam_proxy_eu_central_1.arn
    vpc_security_group_ids = [aws_security_group.rds.id]
    vpc_subnet_ids         = module.link_delivery_eu_central_1.private_subnets_ids
  
    auth {
      auth_scheme = &quot;SECRETS&quot;
      description = &quot;allows the connection to the aurora db&quot;
      iam_auth    = &quot;DISABLED&quot;
      secret_arn  = &quot;arn:aws:secretsmanager:eu-central-1:[account]:secret:[company]/aurora-Pa40We&quot;
    }
  
    tags = {
      Name = &quot;aurora proxy&quot;
    }
  }
  
  resource &quot;aws_db_proxy_default_target_group&quot; &quot;proxy_eu_central_1&quot; {
    db_proxy_name = aws_db_proxy.proxy_eu_central_1.name
  
    connection_pool_config {
      connection_borrow_timeout    = 120
      init_query                   = &quot;SET x=1, y=2&quot;
      max_connections_percent      = 100
      max_idle_connections_percent = 50
      session_pinning_filters      = [&quot;EXCLUDE_VARIABLE_SETS&quot;]
    }
  }
  
  resource &quot;aws_db_proxy_target&quot; &quot;proxy_eu_central_1&quot; {
    db_cluster_identifier  = module.aurora.rds_cluster_id
    db_proxy_name          = aws_db_proxy.proxy_eu_central_1.name
    target_group_name      = aws_db_proxy_default_target_group.proxy_eu_central_1.name
  }
  </code></pre>