Amazon Aurora Connection

The Amazon Aurora connection type enables automations to query and write data to Aurora database clusters running on AWS, supporting both MySQL-compatible and PostgreSQL-compatible engines. It is used by the plugin-sql-databases plugin, which delegates to the sql-database-connector.

Connection Type

Property	Value
Type ID	AURORA
Category	Relational Databases
Testable	Yes
Entity class	DBConnectionDetails

Friendly Example

What you enter	Example
Connection name	Aurora - Finance Reports
Used for	Reading approved finance records for month-end reconciliation jobs
Main details to collect	Cluster endpoint, port, database name, username, and password (or IAM role)
Best person to provide it	AWS or database administrator

After it is saved, workflow builders select Aurora - Finance Reports in a node instead of entering these details again.

Connection Modes

Mode	When to use
All Details	Provide the cluster endpoint, port, database name, username, and password individually. The platform builds the JDBC URL automatically.
JDBC URL	Paste a full JDBC connection string directly. Useful when your DBA provides a pre-built URL or when you need precise control over connection parameters.

Writer vs. Reader Endpoint

Aurora exposes two endpoint types. Use the cluster (writer) endpoint for automations that insert or update data. Use the reader endpoint for read-only reporting jobs to reduce load on the primary instance.

Mandatory Fields

Field	What It Means	Example
host	Aurora cluster endpoint (writer) or reader endpoint. Found in the AWS RDS console under the cluster's Connectivity tab.	my-cluster.cluster-abc123.us-east-1.rds.amazonaws.com
port	TCP port the engine listens on. Default is 3306 for MySQL-compatible, 5432 for PostgreSQL-compatible.	3306
database	Name of the database to connect to	finance_db
username	Database login username	qinfinite_automation
password	Password for the database user. Encrypted at rest. Omit when using IAM authentication.	••••••••

JDBC URL Format

MySQL-compatible Aurora:

jdbc:mysql://my-cluster.cluster-abc123.us-east-1.rds.amazonaws.com:3306/finance_db

PostgreSQL-compatible Aurora:

jdbc:postgresql://my-cluster.cluster-abc123.us-east-1.rds.amazonaws.com:5432/finance_db

SSL/TLS in the JDBC URL

AWS Aurora enforces SSL by default. To explicitly enable and verify the connection:

MySQL-compatible:

jdbc:mysql://my-cluster.cluster-abc123.us-east-1.rds.amazonaws.com:3306/finance_db?useSSL=true&requireSSL=true&verifyServerCertificate=true

PostgreSQL-compatible:

jdbc:postgresql://my-cluster.cluster-abc123.us-east-1.rds.amazonaws.com:5432/finance_db?ssl=true&sslmode=verify-full

Advanced Fields

Field	What It Means	Example
authentication	Authentication method. Set to iamRole to use AWS IAM database authentication instead of a static password. Defaults to password.	iamRole
region	AWS region where the Aurora cluster is deployed. Required when authentication is iamRole.	us-east-1
sslMode	SSL enforcement level. Options: disabled, preferred, required, verify-ca, verify-full.	required
connectionTimeout	Maximum time in milliseconds to wait when establishing a connection before failing.	10000

IAM Authentication

When authentication is set to iamRole, the platform generates short-lived authentication tokens using the AWS SDK. The database user must exist in the database and must be granted the rds_iam role (MySQL) or the rds_iam privilege (PostgreSQL). The password field is ignored in this mode.

Setup Instructions

1. Open the AWS RDS console and navigate to Databases. Select your Aurora cluster and open the Connectivity & security tab. Copy the Writer endpoint (for write-capable connections) or the Reader endpoint (for read-only connections), along with the port number.

2. Create a dedicated database user with the minimum permissions required:

   MySQL-compatible:

   CREATE USER 'qinfinite_automation'@'%' IDENTIFIED BY 'strong-password';
   GRANT SELECT, INSERT, UPDATE, DELETE ON finance_db.* TO 'qinfinite_automation'@'%';
   FLUSH PRIVILEGES;

   PostgreSQL-compatible:

   CREATE USER qinfinite_automation WITH PASSWORD 'strong-password';
   GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO qinfinite_automation;

3. Allow network access. In the cluster's VPC security group, add an inbound rule permitting TCP traffic on the database port from the Qinfinite platform's IP address or security group.

4. (Optional) Configure IAM authentication if you prefer token-based access over a static password. Enable IAM database authentication on the cluster, create a database user with the rds_iam role, and ensure the platform's IAM role has the rds-db:connect permission.

5. Create the connection in the Global Configurator and click Test Connection to verify credentials and network access.

Troubleshooting

Symptom	Likely Cause
Communications link failure or Connection refused	The platform cannot reach the Aurora endpoint on the specified port. Check VPC security groups, subnet routing, and whether the cluster is in a publicly accessible subnet if the platform is outside the VPC.
Access denied for user '...'@'...'	Wrong username or password, or the user account does not permit connections from the platform's IP. Check the GRANT host pattern.
SSL connection error	Aurora requires SSL and the JDBC URL is missing SSL parameters. Add useSSL=true (MySQL) or ssl=true (PostgreSQL) to the URL.
IAM token authentication fails	The platform's IAM role lacks the rds-db:connect permission, or the database user is missing the rds_iam role. Check IAM policies and the database user definition.