Support MySQL Connector/J loadbalance:// protocol with IAM authentication

[bhavin2211]

Describe the feature

Enable the AWS Advanced JDBC Wrapper's IAM authentication plugin to work with MySQL Connector/J's loadbalance:// protocol, allowing query-level load balancing across RDS MySQL read replicas while using IAM database authentication.

Currently, the wrapper's object identity checks fail when the MySQL driver switches between connection objects during load balancing, making it impossible to use both IAM authentication and the driver's native load balancing feature together.

This feature would allow JDBC URLs like:
jdbc:aws-wrapper:mysql:loadbalance://replica1.rds.amazonaws.com,replica2.rds.amazonaws.com,replica3.rds.amazonaws.com:
to work correctly with IAM authentication, providing:

• Automatic query distribution across read replicas
• IAM token-based authentication with credential rotation

Without this feature, users must choose between IAM authentication OR load balancing, or migrate to Aurora, or implement complex application-level workarounds.

Use Case

Our current setup would like to use Wrapper to leverage IAM Authentication,

• Adopt IAM database authentication for improved security and automatic credential rotation,
• Maintain query-level load balancing across read replicas.

This feature would allow to use IAM Plugin for AWS RDS with MySQL driver, potentially even postgress driver should face the same issue since the library expects database instance to be resolved while checking for switch between connection.

Proposed Solution

Modify the wrapper to detect and handle when the underlying MySQL driver switches connection objects during load balancing by maybe implementing a connection proxy that delegates to the current active connection.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

The AWS Advanced JDBC Driver version used

aws-advanced-jdbc-wrapper-2.4.0

JDK version used

jdk21

Operating System and version

AL2

[sergiyvamz]

Hi @bhavin2211

Thank you for suggesting this enhancement. Would you mind to answer few questions to clarify your idea.

• What database type are you planning to use it? Aurora, RDS Cluster, RDS Instance, plain Mysql?
• Are you expecting to provide a list of read replicas only in the connection string?
• This load balancing solution works for read traffic only, doesn't it?

As an alternative solution to consider, you can use cluster reader endpoint for your Aurora or RDS Cluster and use initialConnection plugin to do load balancing.
https://github.com/aws/aws-advanced-jdbc-wrapper/blob/main/docs/using-the-jdbc-driver/using-plugins/UsingTheAuroraInitialConnectionStrategyPlugin.md

[bhavin2211]

Hi @bhavin2211

Thank you for suggesting this enhancement. Would you mind to answer few questions to clarify your idea.

• What database type are you planning to use it? Aurora, RDS Cluster, RDS Instance, plain Mysql?

• RDS MySQL Instance (master-replica)

• Are you expecting to provide a list of read replicas only in the connection string?

• yes provide replica in the connection string

• This load balancing solution works for read traffic only, doesn't it?

• Yes, loadbalance is only needed for read traffic.

As an alternative solution to consider, you can use cluster reader endpoint for your Aurora or RDS Cluster and use initialConnection plugin to do load balancing. https://github.com/aws/aws-advanced-jdbc-wrapper/blob/main/docs/using-the-jdbc-driver/using-plugins/UsingTheAuroraInitialConnectionStrategyPlugin.md

• initialConnection plugin is only compatible for Aurora

[sergiyvamz]

Hi @bhavin2211

Thank you provided answers. I still not sure I understand your desired configuration. You mentioned that you're planning to use this configuration with RDS MySQL Instance that is not a cluster but a single instance DB. What connection string do you want to use in this case? Will it be a single host name in the connection string or several host names? Can you give an example?

[bhavin2211]

Hi @sergiyvamz,

Let me clarify the RDS MySQL setup I'm referring to:

Database Architecture:
• 1 RDS MySQL master instance (for writes)
• Multiple RDS MySQL read replica instances (for reads)
• This is standard RDS MySQL master-replica topology, not Aurora clustering

Current Behavior:
The wrapper transforms this to jdbc:mysql:loadbalance://... which MySQL Connector/J rejects as malformed, causing "No suitable driver found" errors.

e.g. jdbc:mysql:loadbalance://replica1.xyz:3306,replica2.xyz:3306,replica3.xyz:3306/database?user=db_user&useSSL=true&requireSSL=true

Use Case:
• Write queries go to master instance (separate connection)
• Read queries use load balancing across read replicas with IAM auth
• Need query-level distribution, not just connection-level

We need the MySQL Connector/J's native loadbalance:// protocol to work with the wrapper's
IAM authentication.

[sergiyvamz]

Hi @bhavin2211

Thank you for your clarification. We'll add this feature to our list. However, we cannot guarantee its implementation timeline or availability date.