Method getRDSConnection

backend/plugin/db/mysql/mysql.go:198–252

getRDSConnection returns the connection string with IAM for AWS RDS. refs: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.Go.html https://repost.aws/knowledge-center/rds-mysql-access-denied

(ctx context.Context, connCfg db.ConnectionConfig)

// https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.Go.html
// https://repost.aws/knowledge-center/rds-mysql-access-denied
func (d *Driver) getRDSConnection(ctx context.Context, connCfg db.ConnectionConfig) (string, error) {
	dbEndpoint := fmt.Sprintf("%s:%s", connCfg.DataSource.Host, connCfg.DataSource.Port)
	cfg, err := util.GetAWSConnectionConfig(ctx, connCfg)
	if err != nil {
		return "", errors.Wrap(err, "load aws config failed")
	}

	// Handle cross-account role assumption if configured
	if err := util.AssumeRoleIfNeeded(ctx, &cfg, connCfg.ConnectionContext, connCfg.DataSource.GetAwsCredential()); err != nil {
		return "", err
	}

	authenticationToken, err := auth.BuildAuthToken(
		ctx, dbEndpoint, connCfg.DataSource.GetRegion(), connCfg.DataSource.Username, cfg.Credentials)
	if err != nil {
		return "", errors.Wrap(err, "failed to create authentication token")
	}

	// Get RDS CA certificate pool
	rootCertPool, err := getRDSCertPool(ctx)
	if err != nil {
		return "", errors.Wrap(err, "failed to get RDS cert pool")
	}

	// Create TLS config with unique name for this connection
	tlsKey := uuid.NewString()

	var tlsConfig *tls.Config
	if connCfg.DataSource.GetVerifyTlsCertificate() {
		// Secure config with certificate verification
		tlsConfig = &tls.Config{
			RootCAs:            rootCertPool,
			InsecureSkipVerify: true, // We use custom verification
		}
		tlsConfig.VerifyPeerCertificate = util.CreateCertificateVerifier(rootCertPool, connCfg.DataSource.Host)
	} else {
		// Backward compatible config without verification
		tlsConfig = &tls.Config{
			RootCAs:            rootCertPool,
			InsecureSkipVerify: true,
		}
	}

	// Register the TLS config with unique name
	if err := mysql.RegisterTLSConfig(tlsKey, tlsConfig); err != nil {
		return "", errors.Wrap(err, "failed to register RDS TLS config")
	}

	// Clean up the TLS config after connection
	d.openCleanUp = append(d.openCleanUp, func() { mysql.DeregisterTLSConfig(tlsKey) })

	return fmt.Sprintf("%s:%s@tcp(%s)/%s?tls=%s&allowCleartextPasswords=true&multiStatements=true&maxAllowedPacket=0",
		connCfg.DataSource.Username, authenticationToken, dbEndpoint, connCfg.ConnectionContext.DatabaseName, tlsKey,
	), nil
}

func getCloudSQLConnection(ctx context.Context, connCfg db.ConnectionConfig) (string, error) {
	d, err := util.GetGCPConnectionConfig(ctx, connCfg)