RDSClient::GenerateConnectAuthToken doesn't work (whereas the cli: aws rds --generate-db-auth-token does)

[MCox-cat]

As per https://stackoverflow.com/questions/50120593/aws-c-rds-generateconnectauthtoken-does-not-work-works-from-aws-cli I am trying to get the RDS auth token from the C++ SDK in a similar way that I can get the token from the AWS CLI.

Now, If I insert the aws rds --generate-db-auth-token output in to my c++ application, it works. But if I insert the output of RDSClient::GenerateConnectAuthToken, that doesn't work.

Do I need to copy what's described here (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.Java.html) about manually signing ?

Any help, much appreciated.

Windows
AWSSDKCPP-RDS.1.4.20141031.34
Visual Studio 2017

[MCox-cat]

Further investigation shows that it appears to be an IAM issue as using my IAM User credentials provides a valid token. Using IAM Role based credentials doesn't work despite the IAM DB access being set and the policy being set.
Raising a AWS Support ticket to find out whats wrong.

[Bu11etmagnet]

How does the output of RDSClient::GenerateConnectAuthToken differ from the output of aws rds --generate-db-auth-token ?

[MCox-cat]

It's quite similar, but not exactly the same.

[MCox-cat]

Despite my comment above, the C++ "RDSClient::GenerateConnectAuthToken" has never produced a valid token for me regardless of the credentials I give it. I've only been able to get it to work correctly with the Java RDsIamGenerator thing, or the CreateManually... java example (with a slight tweak), or via the AWS Cli.

[Bu11etmagnet]

The format emitted by the C++ SDK seems to be wrong:

CLI: mysql-instance.us-west-2.rds.amazonaws.com/?Action=connect&DBUser=TheUser&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAKIAKIAKIAKIAKIAA%2F20180504%2Fus-west-2%2Frds-db%2Faws4_request&X-Amz-Date=20180504T154229Z&X-Amz-Expires=900&X-Amz-SignedHeaders=host&X-Amz-Signature=c1b437bdfaabc6c32e9706927aa3dc79d3749a3c35fd663e90d0b2682ae03e64
C++: mysql-instance.us-west-2.rds.amazonaws.com?Action=connect&DBUser=TheUser&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAKIAKIAKIAKIAKIAA%2F20180504%2Fus-west-2%2Frds-db%2Faws4_request&X-Amz-Date=20180504T154156Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=f3e5733eea446765905188275474b6217b77af33e8e641ec07883c8d3fdc4a3d

There is no '/' after the host name.
This is with C++ SDK Version: 1.4.42

[MCox-cat]

I found the same, but putting the '/' in didn't fix it for me. Nor did replicating the order of the arguments. For me the c++ version produces a longer output as well

…

________________________________ From: Ráduly, Csaba <notifications@github.com> Sent: Friday, May 4, 2018 4:49:23 PM To: aws/aws-sdk-cpp Cc: Michael Cox; Author Subject: Re: [aws/aws-sdk-cpp] RDSClient::GenerateConnectAuthToken doesn't work (whereas the cli: aws rds --generate-db-auth-token does) (#861) The format emitted by the C++ SDK seems to be wrong: CLI: mysql-instance.us-west-2.rds.amazonaws.com/?Action=connect&DBUser=TheUser&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAKIAKIAKIAKIAKIAA%2F20180504%2Fus-west-2%2Frds-db%2Faws4_request&X-Amz-Date=20180504T154229Z&X-Amz-Expires=900&X-Amz-SignedHeaders=host&X-Amz-Signature=c1b437bdfaabc6c32e9706927aa3dc79d3749a3c35fd663e90d0b2682ae03e64 C++: mysql-instance.us-west-2.rds.amazonaws.com?Action=connect&DBUser=TheUser&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAKIAKIAKIAKIAKIAA%2F20180504%2Fus-west-2%2Frds-db%2Faws4_request&X-Amz-Date=20180504T154156Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=f3e5733eea446765905188275474b6217b77af33e8e641ec07883c8d3fdc4a3d There is no '/' after the host name. This is with C++ SDK Version: 1.4.42 — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<#861 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AWXZSuF8CvVZSanTosjEkATKXc0h53Xqks5tvHiDgaJpZM4Tu5Id>.

[Bu11etmagnet]

The signature at the end may be different because of the missing '/'. Also, the "X-Amz-Expires" is different (900 for the CLI, 3600 for the SDK) which may also influence the signature.

Anyway, I don't believe you should alter the string you got from GenerateConnectAuthToken. That's a sure way to get rejected.

[MCox-cat]

You can make the string yourself if you can implement the CreateRDSAuthTokenManually (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.Java.html), which works (beware the slight bug with the date format).

[Bu11etmagnet]

The cause of the missing '/' seems to be in Aws::String URI::GetURIString(bool includeQueryString) const (URI.cpp:322), which does

        if(m_path != "/")                                                                                                                                                                                 
        {                                                                                                                                                                                                 
            ss << URLEncodePathRFC3986(m_path);                                                                                                                                                           
        }                                                                                                                                                                                                 

As it happens, m_path is precisely "/", so it gets omitted. However, this is not the cause of the signature mismatch. By the time GetURIString is called, the signature has been already computed.

[MCox-cat]

@Bu11etmagnet A related question, are you trying to get a token for use by an IAM role / Cognito user, or just using IAM User credentials?

[Bu11etmagnet]

Sorry, I don't understand what you mean by "just using IAM User credentials".
I'm trying to generate a token to access and RDS Aurora DB, which has IAM authentication turned on.

[MCox-cat]

I mean, which credentials (AWSCredentials) are you using? Hard-coded from your Aws IAM User, or obtained programmatically from some other source (such as via logging in with Cognito Identity Pool and obtaining a IAM Role/Credentials that way)

[Bu11etmagnet]

I think both the C++ SDK and the AWS CLI are using credentials from ~/.aws/credentials

[MCox-cat]

Depends how you create the RDSClient. I'm using this one as I want to provide temporary credentials as returned by Cognito. https://sdk.amazonaws.com/cpp/api/LATEST/class_aws_1_1_r_d_s_1_1_r_d_s_client.html#a8a62509dd306e0eb41a91295c9a77030