apache/druid · error · RuntimeException

Couldn't generate AWS token.

Error message

Couldn't generate AWS token.

What it means

AWSRDSTokenPasswordProvider generates an RDS IAM authentication token each time a password is requested. If any step (credentials resolution, RdsAuthTokenBuilder call, SDK interaction) throws, it logs and rethrows as a Druid RE('Couldn't generate AWS token.'). It means the IAM auth token for the RDS connection could not be produced.

Source

Thrown at extensions-core/druid-aws-rds-extensions/src/main/java/org/apache/druid/aws/rds/AWSRDSTokenPasswordProvider.java:121

          .builder()
          .credentialsProvider(awsCredentialsProvider)
          .region(Region.of(region))
          .build();

      String authToken = rdsUtilities.generateAuthenticationToken(
          GenerateAuthenticationTokenRequest
              .builder()
              .hostname(host)
              .port(port)
              .username(user)
              .build()
      );

      return authToken;
    }
    catch (Exception ex) {
      LOGGER.error(ex, "Couldn't generate AWS token.");
      throw new RE(ex, "Couldn't generate AWS token.");
    }
  }
}

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Check AWS credentials and IAM permission rds-db:connect for the principal
2. Verify provider config: region, hostname, port, username, and ssl settings match the RDS instance
3. Test token generation with aws rds generate-db-auth-token from the same environment to isolate config vs code
4. Check network reachability and system clock skew

Example fix

// before
{"type":"aws-rds-token"} // missing region/user
// after
{"type":"aws-rds-token","region":"us-east-1","dbUser":"druid_user","host":"mydb.x.us-east-1.rds.amazonaws.com","port":3306}

// Pre-check before using the provider
Process p = Runtime.getRuntime().exec(new String[]{"aws","rds","generate-db-auth-token",
  "--hostname", host, "--port", port, "--username", dbUser, "--region", region});

try {
  String token = passwordProvider.getPassword();
} catch (RE e) {
  if (e.getMessage().contains("Couldn't generate AWS token")) {
    // check credentials/region config, then retry with backoff
  } else throw e;
}

When it happens

Trigger: Calling getPassword() when the RdsAuthTokenBuilder fails: invalid/missing AWS credentials, wrong region or hostname/port, expired credentials, or SDK/network errors while signing.

Common situations: Misconfigured region/host in the password provider spec, EC2 instance role lacking rds-db:connect permission, clock skew invalidating signatures, or network egress to STS/RDS blocked.

Related errors

• Failed to initialize Glue catalog
• StreamException
• Failed to get object summaries from S3 bucket[%s], prefix[%s
• Couldn't delete segments from S3. See the task logs for more
• Couldn't kill segment[%s]: [%s]

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/dd261f6b4382f1c7. Report an issue: GitHub.