Understanding AWS IAM Authentication Token Behavior for Database Connections
Article ID: 450931
Updated On:
Products
Issue/Introduction
You want to use an AWS IAM role to generate a temporary 15-minute token as a database password to improve security and avoid hardcoded credentials. You have questions regarding whether the database connection remains active or if it terminates when the 15-minute token expires.
Environment
- AWS RDS (MySQL)
- Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)
Resolution
The AWS IAM authentication token acts as a password only during the initial connection setup.
Once the TCP connection is authenticated and opened, AWS RDS does not terminate or re-authenticate it when the token expires. The 15-minute validity window applies only to initiating new connections, not maintaining active ones. Therefore, using the 15-minute IAM token works as expected for your setup, and existing connections remain stable beyond the token's expiration.
Note: As a best practice, always validate authentication workflows in your non-production environment before applying them to Production.
Additional Information
Feedback
