DBS-C01 Database Security Practice Question
A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The DBA did not create a database user that is set to use IAM authentication.
IAM database authentication requires that a database user be created with the IAM authentication method. Specifically, the user must be created with the CREATEROLE privilege and granted the rds_iam role. Without this step, the authentication fails even if the IAM role is correctly configured. Option B is incorrect because the IAM policy was already attached. Option C is incorrect because IAM authentication does not require a password; it uses authentication tokens. Option D is incorrect because the security group and port are not related to IAM authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The DBA did not create a database user that is set to use IAM authentication.
Why this is correct
When using IAM database authentication, you must create a database user that is set to authenticate using IAM. This is done by creating the user with the CREATEROLE option and granting rds_iam role. Without this, authentication fails. This is the missed step.
- ✗
The DBA did not attach the IAM policy to the ECS task role.
Why it's wrong here
The IAM policy was already attached to the ECS task role, so this is not the issue.
- ✗
The DBA did not enable the 'password' authentication method.
Why it's wrong here
IAM authentication does not require a password; it uses authentication tokens generated by AWS. Enabling password authentication is unnecessary and not relevant.
- ✗
The DBA did not update the security group to allow traffic on port 5432.
Why it's wrong here
The security group configuration for port 5432 is not related to IAM authentication. The connection error is about IAM authentication not enabled for the user, not network connectivity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is configuring an Amazon RDS for PostgreSQL DB instance. The application connects using IAM database authentication. Which setting must be enabled on the DB instance for IAM authentication to work?
easy- A.Set the database port to 5432.
- ✓ B.Set the 'rds.force_ssl' parameter to 1.
- C.Ensure the DB instance is publicly accessible.
- D.Change the master username to 'iam_user'.
Why B: IAM database authentication for Amazon RDS PostgreSQL requires an encrypted connection to protect the authentication token. Setting the 'rds.force_ssl' parameter to 1 enforces TLS/SSL connections between the client and the database, which is a prerequisite for IAM authentication. Option A is incorrect because the port (default 5432) does not need to change for IAM. Option C is incorrect because the DB instance can be private within a VPC; IAM authentication works over private or public connections as long as TLS is enforced. Option D is incorrect because the master username is not changed; IAM authentication uses database users that are mapped to IAM identities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.