> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/connections/authentication/configure-aws-passwordless-authentication-using-amazon-rds-postgresql-as-the-metastore.md).

# Configure AWS passwordless authentication using Amazon RDS PostgreSQL as the Metastore

This page shows you how to configure passwordless authentication for the Metastore in Amazon RDS.

AWS passwordless authentication is an optional feature that allows Data Quality & Observability (self-hosted) to connect to a database without specifying a password.

Typically, database passwords are set in the application configuration, but by leveraging the AWS passwordless option, Data Quality & Observability (self-hosted) retrieves a temporary password from AWS instead. This temporary password is most commonly referred to as a token, which is a lengthy credential containing a password and non-password information, such as how long the token is valid. When configured for the purpose of passwordless authentication, the AWS RDS PostgreSQL database accepts this token instead of a traditional password.

Data Quality & Observability (self-hosted) notes how long the token is valid and stores it in its memory. Whenever a database request is made, Data Quality & Observability (self-hosted) verifies whether the token is still valid, and if it isn't, a new token is requested via an HTTP call from Data Quality & Observability (self-hosted) to AWS.

{% hint style="info" %}
AWS passwordless authentication is currently only supported for EC2 Instance Profile-based authentication with an Amazon RDS Metastore for Data Quality & Observability (self-hosted) standalone and cluster-based deployments. IAM pod role-based authentication support will be available in a future release.
{% endhint %}

## Prerequisites

{% tabs %}
{% tab title="Standalone" %}

* The Amazon RDS instance must have the IAM authentication method enabled.
* A user must be created in the Amazon RDS database and given the role **rds\_iam**.
* A matching user must be created in AWS with permission to connect to Amazon RDS.
* The ec-2 instance to which Data Quality & Observability (self-hosted) is deployed must have permission to connect to Amazon RDS.

{% hint style="success" %}
For more information, see the official AWS documentation on [Using IAM Authentication with PostgreSQL](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html#UsingWithRDS.IAMDBAuth.DBAccounts.PostgreSQL) and [Creating and using an IAM policy for IAM database access](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html) .
{% endhint %}
{% endtab %}

{% tab title="Cloud Native" %}

* The Amazon RDS instance must have the IAM authentication method enabled.
* A user must be created in the Amazon RDS database and given the role **rds\_iam**.
* A matching user must be created in AWS with permission to connect to Amazon RDS.
* The EKS instance to which Data Quality & Observability (self-hosted) is deployed must have permission to connect to Amazon RDS.

{% hint style="success" %}
For more information, see the official AWS documentation on [Using IAM Authentication with PostgreSQL](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html#UsingWithRDS.IAMDBAuth.DBAccounts.PostgreSQL) and [Creating and using an IAM policy for IAM database access](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html) .
{% endhint %}
{% endtab %}
{% endtabs %}

## Setting up AWS passwordless authentication

{% tabs %}
{% tab title="Standalone" %}
{% stepper %}
{% step %}
Open the **owl-env.sh** file.
{% endstep %}

{% step %}
Export the Spring profile "AWS\_ENV" environment variable with the following command:

* `export SPRING_PROFILES_ACTIVE=AWS_ENV`
  {% endstep %}

{% step %}
Export the Spring data source URL environment variables with the following commands, replacing the parameterized `${RDS-url}` sections with your Amazon RDS JDBC URL:

* `export SPRING_DATASOURCE_URL=${RDS-url}?authenticationPluginClassName=com.collibra.dq.platform.datasource.aws.AwsPostgresAuthenticationPlugin`

  <div data-gb-custom-block data-tag="hint" data-style="success" class="hint hint-success"><p>If your URL already has a parameter, use <code>&#x26;</code> instead of <code>?</code>.</p></div>
* `export SPRING_AGENT_DATASOURCE_URL=${RDS-url}`
  {% endstep %}

{% step %}
Export the Spring data source username environment variables with the following commands, replacing the parameterized `${RDS-username}` sections with the Amazon RDS username configured with the profile **rds\_iam**:

* `export SPRING_DATASOURCE_USERNAME=${RDS-username}`
* `export SPRING_AGENT_DATASOURCE_USERNAME=${RDS-username}`
  {% endstep %}

{% step %}
Export the Spring data source password environment variables with the following commands, replacing the parameterized `${value}` sections with a non-empty value:

* `export SPRING_DATASOURCE_PASSWORD=${value}`
* `export SPRING_AGENT_DATASOURCE_PASSWORD=${value}`

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The password properties are not used for the connection, but Data Quality &#x26; Observability (self-hosted) requires them to be present.</p></div>

{% endstep %}

{% step %}
Save and close the **owl-env.sh** file.
{% endstep %}

{% step %}
Open the **owl.properties** file.
{% endstep %}

{% step %}
Replace the parameterized `${RDS-url}?authenticationPluginClassName=com.collibra.dq.platform.datasource.aws.AwsPostgresAuthenticationPlugin` sections in spring.datasource.url with your Amazon RDS JDBC URL. Ensure that the Amazon RDS instance has the IM permissions for Passwordless enabled.

<i class="fa-glasses-round">:glasses-round:</i> Example: `spring.datasource.url=${RDS-url}?authenticationPluginClassName=com.collibra.dq.platform.datasource.aws.AwsPostgresAuthenticationPlugin`

***

{% endstep %}

{% step %}
Add the following properties to the configuration file:

```
# Replace {RDS_username} with the Amazon RDS username configured with the profile rds_iam
spring.datasource.username={RDS_username}
 
# Replace {value} with a non-empty value
spring.datasource.password={value}
```

{% endstep %}

{% step %}
Save and close the **owl.properties** file.
{% endstep %}

{% step %}
Restart the Data Quality & Observability (self-hosted) Web App.
{% endstep %}
{% endstepper %}
{% endtab %}

{% tab title="Cloud Native" %}

1. Deploy Data Quality & Observability (self-hosted) with the following Helm Chart variables, replacing the parameterized `${value}` sections with your AWS RDS Metastore details:

   ```
   --set global.configMap.data.active_profile=AWS_ENV
   --set global.configMap.data.metastore_url="${value}?authenticationPluginClassName=com.collibra.dq.platform.datasource.aws.AwsPostgresAuthenticationPlugin"
   --set global.configMap.data.metastore_user="${value}"
   --set global.configMap.data.metastore_pass="${value}"
   ```
2. Validate that the **dq-agent** and **dq-web** pods restarted with the appropriate configuration values after the deployment completes.
   {% endtab %}
   {% endtabs %}

## Troubleshooting

<table><thead><tr><th width="152">Problem</th><th>Possible solution</th></tr></thead><tbody><tr><td>I cannot connect to the database. I see a PAM Authentication error in my stacktrace.</td><td><p>Generally, this indicates an issue with the AWS configuration. Confirm that you can connect to the database using AWS authentication via the AWS cli or a different method outside of Data Quality &#x26; Observability (self-hosted). You can use AWS tools to generate a token and connect.</p><p>Follow the instructions in the official AWS documentation to <a href="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.AWSCLI.PostgreSQL.html">verify database connectivity</a> .</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Depending on your database configuration you may need to perform these steps from within an EC2 instance that has appropriate access to your RDS IAM-enabled database.</p></div></td></tr><tr><td>I have verified that I can connect to my database via IAM authentication, but I still see authentication errors in my stack trace.</td><td><p>Closely analyze your IAM policy from the resource running Data Quality &#x26; Observability (self-hosted) to the RDS resource.</p><p>See the official AWS documentation to <a href="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html">using an IAM policy for IAM database access</a> .</p></td></tr><tr><td>After one hour, I notice that the <strong>Connections</strong> section of Data Quality &#x26; Observability (self-hosted) is missing connections. When I have developer tools open in my web browser, I see the failed connections in the network tab.</td><td>This is a known issue that affects certain configurations. It will be fixed in a future release. As of today, the only workaround is to restart your application.</td></tr></tbody></table>