AWS Lambda连接RDS Proxy失败：IAM认证错误(28P01)排查

问题概述 #

通过AWS CLI结合IAM认证可成功连接AWS RDS Proxy，但在Lambda函数中执行相同连接逻辑时，触发错误码28P01的IAM认证失败。将CLI生成的token硬编码到Lambda中却能正常连接。

可用的CLI命令 #

PGPASSWORD=$(aws rds generate-db-auth-token \
  --profile my-profile \
  --hostname rds-proxy-prod.proxy-abc123xyz.us-west-2.rds.amazonaws.com \
  --port 5432 \
  --username dbuser \
  --region us-west-2) \
psql -h rds-proxy-prod.proxy-abc123xyz.us-west-2.rds.amazonaws.com \
     -p 5432 \
     -U dbuser \
     -d mydb \
     --set=sslmode=require

失败的Lambda函数代码 #

const { Client } = require('pg');
const AWS = require('aws-sdk');

module.exports.handler = async (event, context) => {
    const signerConfig = {
        region: 'us-west-2',
        hostname: 'rds-proxy-prod.proxy-abc123xyz.us-west-2.rds.amazonaws.com',
        port: 5432,
        username: 'dbuser'
    };

    const signer = new AWS.RDS.Signer(signerConfig);
    let authToken;

    try {
        authToken = await new Promise((resolve, reject) => {
            signer.getAuthToken({}, (err, token) => {
                if (err) reject(err);
                else resolve(token);
            });
        });
    } catch (error) {
        console.error('Failed to generate auth token:', error);
        return { statusCode: 500, body: JSON.stringify({ error: error.message }) };
    }

    const config = {
        host: 'rds-proxy-prod.proxy-abc123xyz.us-west-2.rds.amazonaws.com',
        port: 5432,
        database: 'mydb',
        user: 'dbuser',
        password: authToken,
        ssl: { rejectUnauthorized: false }
    };

    const client = new Client(config);
    
    try {
        await client.connect();
        const result = await client.query('SELECT NOW()');
        return { statusCode: 200, body: JSON.stringify({ success: true, result: result.rows }) };
    } catch (error) {
        console.error('Database connection failed:', error);
        return { statusCode: 500, body: JSON.stringify({ error: error.message, code: error.code }) };
    } finally {
        await client.end();
    }
};

错误信息 #

The IAM authentication failed for the role dbuser. Check the IAM token for this role and try again.
Code: 28P01

Lambda IAM策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "rds-db:connect",
            "Resource": "arn:aws:rds-db:us-west-2:123456789012:dbuser:rds-proxy-prod/dbuser"
        }
    ]
}

已验证事项 #

• 非网络问题：手动用AWS CLI生成token并硬编码到Lambda中可正常连接
• IAM权限：Lambda执行角色拥有正确的rds-db:connect权限
• RDS Proxy配置：代理已启用IAM认证
• 数据库用户：dbuser存在且已配置IAM认证
• PostgreSQL RDS：数据库认证方式设为Password Authentication

核心问题 #

问题似乎出在Lambda环境中AWS.RDS.Signer生成认证token的方式与AWS CLI的generate-db-auth-token不同。CLI生成的token可用，但Lambda生成的token触发IAM认证失败，也可能与IAM策略有关？

疑问 #

• AWS.RDS.Signer在Lambda与AWS CLI中的generate-db-auth-token工作机制有差异吗？
• RDS IAM认证是否需要Lambda特定配置？
• 是否与Lambda执行上下文或临时凭证有关？

恳请提供关于CLI与Lambda环境中token生成差异的排查思路。

内容的提问来源于stack exchange，提问作者Fahad K