argoproj/argo-workflows · error

SSL must be enabled (ssl: true) when using AWS RDS IAM authe

Error message

SSL must be enabled (ssl: true) when using AWS RDS IAM authentication

What it means

AWS RDS IAM authentication tokens are sent over the connection and require TLS; createPostGresDBSession enforces that ssl is enabled in the PostgreSQL config whenever awsRDSToken is enabled, refusing otherwise. This protects IAM credentials from being sent in cleartext.

Source

Thrown at util/sqldb/sqldb.go:76

		if err != nil {
			return nil, Invalid, err
		}
		return session, MySQL, err
	}
	return nil, "", fmt.Errorf("no databases are configured")
}

// createPostGresDBSession creates postgresDB session
func createPostGresDBSession(ctx context.Context, kubectlConfig kubernetes.Interface, namespace string, cfg *config.PostgreSQLConfig, persistPool *config.ConnectionPool, connectTimeout time.Duration) (db.Session, error) {
	azureEnabled := cfg.AzureToken != nil && cfg.AzureToken.Enabled
	awsEnabled := cfg.AWSRDSToken != nil && cfg.AWSRDSToken.Enabled

	if azureEnabled && awsEnabled {
		return nil, fmt.Errorf("only one of azureToken or awsRDSToken may be enabled, not both")
	}

	if awsEnabled && !cfg.SSL {
		return nil, fmt.Errorf("SSL must be enabled (ssl: true) when using AWS RDS IAM authentication")
	}

	userNameByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.UsernameSecret.Name, cfg.UsernameSecret.Key)
	if err != nil {
		return nil, err
	}

	if azureEnabled {
		return createPostGresDBSessionWithAzure(cfg, persistPool, string(userNameByte), connectTimeout)
	}

	if awsEnabled {
		return createPostGresDBSessionWithAWSRDS(cfg, persistPool, string(userNameByte), connectTimeout)
	}

	passwordByte, err := util.GetSecrets(ctx, kubectlConfig, namespace, cfg.PasswordSecret.Name, cfg.PasswordSecret.Key)
	if err != nil {
		return nil, err

View on GitHub (pinned to 35bff19146)

Solutions

1. Set ssl: true in the postgresql persistence config alongside awsRDSToken.
2. Ensure the RDS endpoint presents a certificate the client trusts (configure RDS CA bundle / sslmode appropriately).
3. If SSL genuinely cannot be used, do not use AWS RDS IAM tokens — switch to passwordSecret-based auth instead.

Example fix

# before
postgresql:
  host: mydb.xxxx.us-east-1.rds.amazonaws.com
  awsRDSToken:
    enabled: true
# after
postgresql:
  host: mydb.xxxx.us-east-1.rds.amazonaws.com
  ssl: true
  awsRDSToken:
    enabled: true

pg := dbConfig.PostgreSQL
awsOn := pg != nil && pg.AWSRDSToken != nil && pg.AWSRDSToken.Enabled
if awsOn && !pg.SSL {
	return errors.New("awsRDSToken requires ssl: true in postgresql config")
}

_, _, err := sqldb.CreateDBSession(ctx, kubectlConfig, namespace, dbConfig)
if err != nil && strings.Contains(err.Error(), "SSL must be enabled") {
	return fmt.Errorf("enable ssl for AWS RDS IAM auth: %w", err)
}

When it happens

Trigger: DBConfig.PostgreSQL has awsRDSToken.enabled: true but ssl is not set to true when CreateDBSession creates the postgres session.

Common situations: Enabling RDS IAM auth on a config originally written for a plain (non-SSL) in-cluster Postgres; forgetting that RDS IAM requires TLS endpoints; copy-pasting a token block without the matching ssl: true flag.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• only one of azureToken or awsRDSToken may be enabled, not bo
• no databases are configured
• unsupported db type %s
• failure to create dynamic client: %w
• failed to append certificates from PEM string

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/138e4537481dea81. Report an issue: GitHub.