{"record":{"id":"dd261f6b4382f1c7","repo":"apache/druid","slug":"couldn-t-generate-aws-token","errorCode":null,"errorMessage":"Couldn't generate AWS token.","messagePattern":"Couldn't generate AWS token\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions-core/druid-aws-rds-extensions/src/main/java/org/apache/druid/aws/rds/AWSRDSTokenPasswordProvider.java","lineNumber":121,"sourceCode":"          .builder()\n          .credentialsProvider(awsCredentialsProvider)\n          .region(Region.of(region))\n          .build();\n\n      String authToken = rdsUtilities.generateAuthenticationToken(\n          GenerateAuthenticationTokenRequest\n              .builder()\n              .hostname(host)\n              .port(port)\n              .username(user)\n              .build()\n      );\n\n      return authToken;\n    }\n    catch (Exception ex) {\n      LOGGER.error(ex, \"Couldn't generate AWS token.\");\n      throw new RE(ex, \"Couldn't generate AWS token.\");\n    }\n  }\n}\n","sourceCodeStart":103,"sourceCodeEnd":125,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-aws-rds-extensions/src/main/java/org/apache/druid/aws/rds/AWSRDSTokenPasswordProvider.java#L103-L125","documentation":"AWSRDSTokenPasswordProvider generates an RDS IAM authentication token each time a password is requested. If any step (credentials resolution, RdsAuthTokenBuilder call, SDK interaction) throws, it logs and rethrows as a Druid RE('Couldn't generate AWS token.'). It means the IAM auth token for the RDS connection could not be produced.","triggerScenarios":"Calling getPassword() when the RdsAuthTokenBuilder fails: invalid/missing AWS credentials, wrong region or hostname/port, expired credentials, or SDK/network errors while signing.","commonSituations":"Misconfigured region/host in the password provider spec, EC2 instance role lacking rds-db:connect permission, clock skew invalidating signatures, or network egress to STS/RDS blocked.","solutions":["Check AWS credentials and IAM permission rds-db:connect for the principal","Verify provider config: region, hostname, port, username, and ssl settings match the RDS instance","Test token generation with aws rds generate-db-auth-token from the same environment to isolate config vs code","Check network reachability and system clock skew"],"exampleFix":"// before\n{\"type\":\"aws-rds-token\"} // missing region/user\n// after\n{\"type\":\"aws-rds-token\",\"region\":\"us-east-1\",\"dbUser\":\"druid_user\",\"host\":\"mydb.x.us-east-1.rds.amazonaws.com\",\"port\":3306}","handlingStrategy":"retry","validationCode":"// Pre-check before using the provider\nProcess p = Runtime.getRuntime().exec(new String[]{\"aws\",\"rds\",\"generate-db-auth-token\",\n  \"--hostname\", host, \"--port\", port, \"--username\", dbUser, \"--region\", region});","typeGuard":null,"tryCatchPattern":"try {\n  String token = passwordProvider.getPassword();\n} catch (RE e) {\n  if (e.getMessage().contains(\"Couldn't generate AWS token\")) {\n    // check credentials/region config, then retry with backoff\n  } else throw e;\n}","preventionTips":["Verify IAM policy grants rds-db:connect to the workload role","Confirm region/host/port/username config matches the RDS instance","Ensure network egress to AWS signing endpoints","Keep instance clocks synchronized (NTP)"],"tags":["aws","rds","iam-auth","database"],"backgroundTag":"missing-credentials","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}