I recently discovered that aws-advanced-jdbc-wrapper is a great library to handle RDS IAM based authentication, since it will refresh the token dynamically for me, so I follow the tutorial in this page:

package software.amazon;

import software.amazon.jdbc.PropertyDefinition;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.Properties;

public class AwsIamAuthenticationPostgresqlExample {
  public static final String POSTGRESQL_CONNECTION_STRING =
      "jdbc:aws-wrapper:postgresql://db-identifier.XYZ.us-east-2.rds.amazonaws.com:5432/employees";
  private static final String USERNAME = "john_smith";

  public static void main(String[] args) throws SQLException {

    final Properties properties = new Properties();

    // Enable AWS IAM database authentication and configure driver property values
    properties.setProperty(PropertyDefinition.PLUGINS.name, "iam");
    properties.setProperty(PropertyDefinition.USER.name, USERNAME);

    // Attempt a connection
    try (Connection conn = DriverManager.getConnection(POSTGRESQL_CONNECTION_STRING, properties);
        Statement statement = conn.createStatement();
        ResultSet result = statement.executeQuery("select aurora_db_instance_identifier()")) {

      System.out.println(Util.getResult(result));
    }
  }
}

The only problem with this approach is that I receive an error:

org.postgresql.util.PSQLExeption: FATAL: PAM authentication failed for user john_smith ...

And that make sense, I’m not providing any certs or ssl information.

I tried to connect using the psql CLI and it worked:

psql "host=$RDSHOST port=$RDSPORT sslmode=verify-ca sslrootcert=global-bundle.pem user=$RDSUSER dbname=$RDSDB"

So my guess is that I just forgot to provide this properties to my application, so I did and tried again:

    properties.setProperty("sslrootcert", "<PATH_TO_GLOBAL_BUNDLE>");
    properties.setProperty("ssl", true);
    properties.setProperty("sslmode", "verify-ca");

No lucky, same error.

Then I imported my global-bundle.pem to my ca-certs using:

keytool -importcert -alias aws-certs -trustcacerts -file /path/to/global-bundle.pem -storepass changeit -cacerts  -noprompt

This time my message error changed (IDK if I’m getting closer or distant from the final solution:

org.postgresql.util.PSQLExeption: Could not open SSL root certificate file /home/<MY_USER>/.postgresql/root.crt

Any thoughts on how to do this please? What am I missing?