title: Stuck on talking to RDS/Aurora from node
body: <p>Thought I'd ask this as my team and I are banging our heads against this.</p>
  
  <p>We are attempting to setup Aurora/RDS (Mysql) access via IAM roles and node.</p>
  
  <p>We've tried a number of different approaches, and two particular node/mysql libraries (<a href="https://github.com/mysqljs/mysql" rel="nofollow noreferrer">https://github.com/mysqljs/mysql</a> and <a href="https://github.com/sidorares/node-mysql2" rel="nofollow noreferrer">https://github.com/sidorares/node-mysql2</a>).</p>
  
  <p>We're able to use the RDS Signer to generate an appropriate token, and we get a valid one back.</p>
  
  <p>We then try to connect to the DB as shown below.  We've tried with a number of different approaches from both of the above libraries - it seems that we need to enable mysql clear password (as per <a href="https://github.com/sidorares/node-mysql2/issues/438#issuecomment-255343793" rel="nofollow noreferrer">https://github.com/sidorares/node-mysql2/issues/438#issuecomment-255343793</a>)</p>
  
  <p>Our code (give or take) is:</p>
  
  <pre><code>var AWS = require('AWS-SDK');
  AWS.config.update({ "accessKeyId": "{valid access key}", "secretAccessKey": "{valid secret access key}", "region": "eu-west-1" });
  
  var mysql = require('mysql2');
  
  var signer = new AWS.RDS.Signer({
      credentials: new AWS.SharedIniFileCredentials({profile: 'default'}),
      region: 'eu-west-1',
      hostname: '{rds database host}',
      port: 3306,
      username: '{rds database username}'
    });
  
    signer.getAuthToken({}, function(err, token){
      console.log(token);
  
      var connection = mysql.createConnection({
          host     : '{rds database host}',
          user     : '{rds database username}',
          password : token,
          port     : 3306,
          database: '{rds database}'
          ,authSwitchHandler: function ({pluginName, pluginData}, cb) {
            if (pluginName === 'mysql_clear_password') {
              // https://dev.mysql.com/doc/internals/en/clear-text-authentication.html
              var password = dbConf.password + '\0';
              var buffer = Buffer.from(password);
              cb(null, buffer);
            } else {
              const err = new Error(`Unknown AuthSwitchRequest plugin name ${pluginName}`);
              err.fatal = true;
              cb(err);
            }
          }
        });
  
        connection.connect(function(err) {
          if (err) {
            console.error('Database connection failed: ' + err.stack);
            return;
          }
  
          console.log('Connected to database.');
        });
  
        connection.end();
  });
  </code></pre>
  
  <p>We get:</p>
  
  <pre><code>Database connection failed: Error: Access denied for user '{dbuser}'@'{ip address}' (using password: YES)
  at Packet.asError (C:\Users\Terry.Brown\Desktop\iam-rds-auth\node_modules\mysql2\lib\packets\packet.js:703:13)
  at ClientHandshake.Command.execute (C:\Users\Terry.Brown\Desktop\iam-rds-auth\node_modules\mysql2\lib\commands\command.js:28:22)
  at Connection.handlePacket (C:\Users\Terry.Brown\Desktop\iam-rds-auth\node_modules\mysql2\lib\connection.js:515:28)
  at PacketParser.onPacket (C:\Users\Terry.Brown\Desktop\iam-rds-auth\node_modules\mysql2\lib\connection.js:94:16)
  at PacketParser.executeStart (C:\Users\Terry.Brown\Desktop\iam-rds-auth\node_modules\mysql2\lib\packet_parser.js:77:14)
  at Socket.&lt;anonymous&gt; (C:\Users\Terry.Brown\Desktop\iam-rds-auth\node_modules\mysql2\lib\connection.js:102:29)
  at emitOne (events.js:115:13)
  at Socket.emit (events.js:210:7)
  at addChunk (_stream_readable.js:250:12)
  at readableAddChunk (_stream_readable.js:237:11)
  </code></pre>
  
  <p>I feel like there's a step we're missing, but I have no idea what it is.  Has anyone solved the aurora/rds / iam / node dance and can give any pointers?</p>
  
  <p>Thanks :)</p>