{"record":{"id":"e722ec0fbcaca4e7","repo":"argoproj/argo-workflows","slug":"only-one-of-azuretoken-or-awsrdstoken-may-be-enabl","errorCode":null,"errorMessage":"only one of azureToken or awsRDSToken may be enabled, not both","messagePattern":"only one of azureToken or awsRDSToken may be enabled, not both","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/sqldb/sqldb.go","lineNumber":72,"sourceCode":"\t\t}\n\t\treturn session, Postgres, err\n\t} else if dbConfig.MySQL != nil {\n\t\tsession, err := createMySQLDBSessionWithCreds(dbConfig.MySQL, dbConfig.ConnectionPool, username, password, dbConfig.ConnectionTimeout())\n\t\tif err != nil {\n\t\t\treturn nil, Invalid, err\n\t\t}\n\t\treturn session, MySQL, err\n\t}\n\treturn nil, \"\", fmt.Errorf(\"no databases are configured\")\n}\n\n// createPostGresDBSession creates postgresDB session\nfunc createPostGresDBSession(ctx context.Context, kubectlConfig kubernetes.Interface, namespace string, cfg *config.PostgreSQLConfig, persistPool *config.ConnectionPool, connectTimeout time.Duration) (db.Session, error) {\n\tazureEnabled := cfg.AzureToken != nil && cfg.AzureToken.Enabled\n\tawsEnabled := cfg.AWSRDSToken != nil && cfg.AWSRDSToken.Enabled\n\n\tif azureEnabled && awsEnabled {\n\t\treturn nil, fmt.Errorf(\"only one of azureToken or awsRDSToken may be enabled, not both\")\n\t}\n\n\tif awsEnabled && !cfg.SSL {\n\t\treturn nil, fmt.Errorf(\"SSL must be enabled (ssl: true) when using AWS RDS IAM authentication\")\n\t}\n\n\tuserNameByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.UsernameSecret.Name, cfg.UsernameSecret.Key)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif azureEnabled {\n\t\treturn createPostGresDBSessionWithAzure(cfg, persistPool, string(userNameByte), connectTimeout)\n\t}\n\n\tif awsEnabled {\n\t\treturn createPostGresDBSessionWithAWSRDS(cfg, persistPool, string(userNameByte), connectTimeout)\n\t}","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/sqldb/sqldb.go#L54-L90","documentation":"createPostGresDBSession supports two cloud IAM token-auth modes for PostgreSQL: Azure (azureToken) and AWS RDS IAM (awsRDSToken). The config enables both simultaneously, which is ambiguous and unsupported, so session creation fails immediately.","triggerScenarios":"DBConfig.PostgreSQL has azureToken.enabled: true AND awsRDSToken.enabled: true at the same time when CreateDBSession creates the postgres session.","commonSituations":"Merging config fragments where each fragment enabled its own cloud token; leftover awsRDSToken block from a migration to Azure (or vice versa); copy-pasted example config containing both blocks.","solutions":["Remove the azureToken block or set azureToken.enabled: false if you intend AWS RDS IAM auth.","Remove the awsRDSToken block or set awsRDSToken.enabled: false if you intend Azure token auth.","Restart the controller/server after fixing the configmap so the new config is loaded."],"exampleFix":"# before\npostgresql:\n  azureToken:\n    enabled: true\n  awsRDSToken:\n    enabled: true\n# after\npostgresql:\n  awsRDSToken:\n    enabled: true","handlingStrategy":"validation","validationCode":"pg := dbConfig.PostgreSQL\nazureOn := pg != nil && pg.AzureToken != nil && pg.AzureToken.Enabled\nawsOn := pg != nil && pg.AWSRDSToken != nil && pg.AWSRDSToken.Enabled\nif azureOn && awsOn {\n\treturn errors.New(\"disable either azureToken or awsRDSToken, not both\")\n}","typeGuard":null,"tryCatchPattern":"_, _, err := sqldb.CreateDBSession(ctx, kubectlConfig, namespace, dbConfig)\nif err != nil && strings.Contains(err.Error(), \"only one of azureToken or awsRDSToken\") {\n\treturn fmt.Errorf(\"config error: pick one cloud IAM token provider: %w\", err)\n}","preventionTips":["Keep only one cloud token block (azureToken or awsRDSToken) in the postgresql config.","When merging config overlays/fragments, check the token blocks don't both end up enabled.","Lint persistence YAML for mutually exclusive fields before rollout."],"tags":["database","configuration","postgres","azure","aws"],"backgroundTag":"conflicting-auth-config","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}