{"record":{"id":"26017356c5f7d891","repo":"argoproj/argo-workflows","slug":"failed-to-build-rds-auth-token-w","errorCode":null,"errorMessage":"failed to build RDS auth token: %w","messagePattern":"failed to build RDS auth token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/sqldb/aws_rds_auth.go","lineNumber":34,"sourceCode":"\tendpoint string\n\tusername string\n\tregion   string\n}\n\nfunc (c *awsRDSConnector) Connect(ctx context.Context) (driver.Conn, error) {\n\topts := []func(*awsconfig.LoadOptions) error{}\n\tif c.region != \"\" {\n\t\topts = append(opts, awsconfig.WithRegion(c.region))\n\t}\n\n\tawsCfg, err := awsconfig.LoadDefaultConfig(ctx, opts...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load AWS config: %w\", err)\n\t}\n\n\ttoken, err := auth.BuildAuthToken(ctx, c.endpoint, awsCfg.Region, c.username, awsCfg.Credentials)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build RDS auth token: %w\", err)\n\t}\n\n\t// Escape single quotes in token for safe DSN interpolation\n\tescapedToken := strings.ReplaceAll(token, \"'\", \"\\\\'\")\n\n\tdsnWithPassword := fmt.Sprintf(\"%s password='%s'\", c.dsn, escapedToken)\n\n\treturn pq.Driver{}.Open(dsnWithPassword)\n}\n\nfunc (c *awsRDSConnector) Driver() driver.Driver {\n\treturn pq.Driver{}\n}\n","sourceCodeStart":16,"sourceCodeEnd":48,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/sqldb/aws_rds_auth.go#L16-L48","documentation":"After loading AWS config, awsRDSConnector.Connect calls auth.BuildAuthToken to generate a presigned RDS IAM authentication token for the DB endpoint/username. If token generation fails (typically because the AWS credentials themselves cannot sign requests, or the region is empty/invalid), Connect wraps the error with \"failed to build RDS auth token\".","triggerScenarios":"auth.BuildAuthToken returns an error when awsCfg.Credentials fails retrieval/refresh at signing time, awsCfg.Region is empty, or the signing operation fails; the caller then wraps it as \"failed to build RDS auth token\".","commonSituations":"Credentials resolved at config-load time have since expired and cannot refresh (expired session tokens in IRSA/IMDS); region resolved to empty string because no region was configured anywhere; clock skew on the host breaking SigV4 signing; RDS endpoint not in the region of the credentials.","solutions":["Verify valid, refreshable AWS credentials are present (IRSA role, instance profile, or fresh env credentials) — re-check with `aws sts get-caller-identity` from the same environment.","Ensure a region is resolvable: set the connector's region field, AWS_REGION/AWS_DEFAULT_REGION env, or region in the AWS config file.","Confirm the DB endpoint/username match an RDS instance with IAM DB authentication enabled and the correct region.","Check host clock skew (NTP) — SigV4 signing fails with large drift.","Read the wrapped %w error: credential refresh errors vs signing errors point at different fixes."],"exampleFix":"// before\nawsCfg, err := awsconfig.LoadDefaultConfig(ctx) // no region anywhere\n// after\nawsCfg, err := awsconfig.LoadDefaultConfig(ctx, awsconfig.WithRegion(\"us-east-1\"))","handlingStrategy":"try-catch","validationCode":"if awsCfg.Region == \"\" {\n    return fmt.Errorf(\"AWS region must be set for RDS IAM auth\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    var cre err := // inspect wrapped cause\n    if strings.Contains(err.Error(), \"failed to build RDS auth token\") {\n        logger.Error(\"RDS IAM token build failed; check credentials/region\", err)\n        return fmt.Errorf(\"rds auth: %w\", err)\n    }\n}","preventionTips":["Enable IAM DB authentication on the RDS instance and grant the user with rds_db role/grant.","Keep credential refresh working: prefer IRSA over static keys that expire.","Sync host clocks with NTP to avoid SigV4 signing failures.","Pin aws-sdk-go-v2 versions and test token generation in CI against a staging RDS."],"tags":["aws","rds","iam","authentication"],"backgroundTag":"aws-iam-auth-token-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}