{"record":{"id":"138e4537481dea81","repo":"argoproj/argo-workflows","slug":"ssl-must-be-enabled-ssl-true-when-using-aws-rds","errorCode":null,"errorMessage":"SSL must be enabled (ssl: true) when using AWS RDS IAM authentication","messagePattern":"SSL must be enabled \\(ssl: true\\) when using AWS RDS IAM authentication","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/sqldb/sqldb.go","lineNumber":76,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, Invalid, err\n\t\t}\n\t\treturn session, MySQL, err\n\t}\n\treturn nil, \"\", fmt.Errorf(\"no databases are configured\")\n}\n\n// createPostGresDBSession creates postgresDB session\nfunc createPostGresDBSession(ctx context.Context, kubectlConfig kubernetes.Interface, namespace string, cfg *config.PostgreSQLConfig, persistPool *config.ConnectionPool, connectTimeout time.Duration) (db.Session, error) {\n\tazureEnabled := cfg.AzureToken != nil && cfg.AzureToken.Enabled\n\tawsEnabled := cfg.AWSRDSToken != nil && cfg.AWSRDSToken.Enabled\n\n\tif azureEnabled && awsEnabled {\n\t\treturn nil, fmt.Errorf(\"only one of azureToken or awsRDSToken may be enabled, not both\")\n\t}\n\n\tif awsEnabled && !cfg.SSL {\n\t\treturn nil, fmt.Errorf(\"SSL must be enabled (ssl: true) when using AWS RDS IAM authentication\")\n\t}\n\n\tuserNameByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.UsernameSecret.Name, cfg.UsernameSecret.Key)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif azureEnabled {\n\t\treturn createPostGresDBSessionWithAzure(cfg, persistPool, string(userNameByte), connectTimeout)\n\t}\n\n\tif awsEnabled {\n\t\treturn createPostGresDBSessionWithAWSRDS(cfg, persistPool, string(userNameByte), connectTimeout)\n\t}\n\n\tpasswordByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.PasswordSecret.Name, cfg.PasswordSecret.Key)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/sqldb/sqldb.go#L58-L94","documentation":"AWS RDS IAM authentication tokens are sent over the connection and require TLS; createPostGresDBSession enforces that ssl is enabled in the PostgreSQL config whenever awsRDSToken is enabled, refusing otherwise. This protects IAM credentials from being sent in cleartext.","triggerScenarios":"DBConfig.PostgreSQL has awsRDSToken.enabled: true but ssl is not set to true when CreateDBSession creates the postgres session.","commonSituations":"Enabling RDS IAM auth on a config originally written for a plain (non-SSL) in-cluster Postgres; forgetting that RDS IAM requires TLS endpoints; copy-pasting a token block without the matching ssl: true flag.","solutions":["Set ssl: true in the postgresql persistence config alongside awsRDSToken.","Ensure the RDS endpoint presents a certificate the client trusts (configure RDS CA bundle / sslmode appropriately).","If SSL genuinely cannot be used, do not use AWS RDS IAM tokens — switch to passwordSecret-based auth instead."],"exampleFix":"# before\npostgresql:\n  host: mydb.xxxx.us-east-1.rds.amazonaws.com\n  awsRDSToken:\n    enabled: true\n# after\npostgresql:\n  host: mydb.xxxx.us-east-1.rds.amazonaws.com\n  ssl: true\n  awsRDSToken:\n    enabled: true","handlingStrategy":"validation","validationCode":"pg := dbConfig.PostgreSQL\nawsOn := pg != nil && pg.AWSRDSToken != nil && pg.AWSRDSToken.Enabled\nif awsOn && !pg.SSL {\n\treturn errors.New(\"awsRDSToken requires ssl: true in postgresql config\")\n}","typeGuard":null,"tryCatchPattern":"_, _, err := sqldb.CreateDBSession(ctx, kubectlConfig, namespace, dbConfig)\nif err != nil && strings.Contains(err.Error(), \"SSL must be enabled\") {\n\treturn fmt.Errorf(\"enable ssl for AWS RDS IAM auth: %w\", err)\n}","preventionTips":["Always pair awsRDSToken.enabled: true with ssl: true in the same config block.","Provision the RDS CA certificate so TLS can actually be verified, not just enabled.","If TLS is not possible in your environment, use passwordSecret auth instead of IAM tokens."],"tags":["database","configuration","postgres","aws","tls"],"backgroundTag":"ssl-required-for-iam-auth","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}