AWS

AWS authentication profiles provide credential management for AWS database services: Amazon RDS and Aurora (PostgreSQL, MySQL, MariaDB), Redshift, Athena, and DynamoDB. DBCode supports both static credentials and AWS profile-based authentication, including full SSO support.

Credential Sources

Source	Use Case	Configuration
Static Credentials	Direct access key authentication	Access Key ID + Secret Access Key
AWS Profile	Profile-based authentication including SSO	Profile name from ~/.aws/config

Static Credentials

Use static credentials when you have long-term IAM access keys:

Required fields:

• Access Key ID: Your AWS access key (starts with AKIA...)
• Secret Access Key: Your AWS secret key

Optional fields:

• Session Token: Required for temporary credentials from STS AssumeRole
• Default Region: AWS region (e.g., us-east-1)

Best for:

• Service accounts with IAM users
• Development environments with dedicated access keys
• Situations where SSO is not available

AWS Profile

Use AWS profiles to leverage your existing AWS CLI configuration, including SSO profiles:

Required fields:

• Profile Name: Profile from ~/.aws/config or ~/.aws/credentials

Optional fields:

• Default Region: Overrides the region from your profile configuration

Supported profile types:

• Standard profiles with static credentials
• SSO profiles configured with aws configure sso
• Assume role profiles
• Credential process profiles
• Temporary credentials written by tools such as aws-azure-login. DBCode re-reads them, so logging in again takes effect without reconnecting.

SSO Authentication

When using an SSO profile, DBCode automatically handles session management:

1. Initial connection: If your SSO session is valid, DBCode uses your cached credentials
2. Expired session: DBCode prompts you to log in with a single click
3. Automatic login: Clicking “Log In” runs aws sso login --profile <name> and opens your browser
4. Credential polling: DBCode waits for you to complete authentication, then continues connecting

Setting Up SSO Profiles

If you haven’t configured an SSO profile yet:

# Configure a new SSO profile
aws configure sso --profile my-sso-profile

# Or manually add to ~/.aws/config:
[profile my-sso-profile]
sso_start_url = https://my-company.awsapps.com/start
sso_region = us-east-1
sso_account_id = 123456789012
sso_role_name = MyRole
region = us-west-2

Supported Databases

The following databases support AWS authentication profiles:

• Athena - Query data in S3 using SQL
• DynamoDB - NoSQL database
• Redshift - Data warehouse, clusters and Serverless
• PostgreSQL, MySQL, and MariaDB - On Amazon RDS and Aurora

Database Sign-In with IAM

For Amazon RDS, Aurora, and Redshift, DBCode uses the profile to get a short-lived database password and refreshes it automatically.

RDS and Aurora (PostgreSQL, MySQL, MariaDB)

1. Turn on IAM database authentication on the instance or cluster.
2. Create the database user for IAM:
   • PostgreSQL: CREATE USER app_user; GRANT rds_iam TO app_user;
   • MySQL and MariaDB: CREATE USER app_user IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
3. Allow rds-db:connect for that user in the IAM policy of the identity your profile uses.
4. In the connection, choose the AWS profile as the Authentication Method, enter the database user as Username, and turn on SSL.

DBCode reads the region from the endpoint hostname. Set AWS Region on the connection when you connect through a custom DNS name.

Redshift

Use the cluster or workgroup endpoint from the AWS console as the host, and turn on SSL.

• Provisioned clusters: enter Database User. The IAM identity needs redshift:GetClusterCredentials. Database Groups and Auto Create User apply here.
• Serverless workgroups: leave Database User empty. Redshift signs you in as your IAM identity. The IAM identity needs redshift-serverless:GetCredentials.

Troubleshooting

”AWS IAM authentication requires SSL”

Cause: RDS accepts IAM sign-in only over SSL.

Solution: Turn on SSL in the connection settings.

”Could not get Redshift credentials”

Cause: AWS rejected the credentials request. The message after the colon comes from AWS.

Solutions:

• Check that the profile’s IAM identity has redshift:GetClusterCredentials (clusters) or redshift-serverless:GetCredentials (Serverless)
• Check that Database User exists or Auto Create User is on (clusters)

“SSO session expired for profile”

Cause: Your AWS SSO session has expired or you haven’t logged in yet.

Solution: Click “Log In” when prompted. DBCode will run aws sso login --profile <name> and open your browser for authentication.

”No AWS profiles found”

Cause: No profiles configured in ~/.aws/config or ~/.aws/credentials.

Solutions:

• Configure a profile using aws configure or aws configure sso
• Verify your AWS config files exist and have valid syntax

”Timed out waiting for SSO login”

Cause: SSO authentication wasn’t completed within 2 minutes.

Solutions:

• Try connecting again and complete the browser authentication promptly
• Check that your SSO portal is accessible
• Verify your SSO profile configuration is correct

”Failed to resolve AWS credentials for profile”

Cause: Profile configuration issue or missing dependencies.

Solutions:

• Verify the profile exists in your AWS config
• For assume role profiles, ensure the source credentials are valid
• Check AWS CLI is installed and configured correctly