can't provide aws_rds_iam_provider_role_arn and aws_rds_iam_region in the same provider block

[kim-anchorzero]

At present if you supply both of these values explicitly in the provider setup aws_rds_iam_region will be ignored when it comes time to generate the temporary auth credentials. This will result in unexpected (and hard to diagnose!) PAM authentication errors because the token generated is effectively invalid..

The issue seems to happen around

terraform-provider-postgresql/postgresql/provider.go

Line 258 in 25fbd1c

if role != "" {

- previously on line 250 we set up the awscfg with the supplied region but then in the block where we handle the role we discard this information when we re-create the awscfg with these new session credentials.

Workaround at the moment is to ensure that the AWS_REGION env var is set though this can cause other issues depending on your AWS provider setups.

[zizzencs]

Nice catch, and sorry for this mistake. This patch should fix he issue:

--- postgresql/provider.go
+++ postgresql/provider.go
@@ -292,6 +292,7 @@
 					*roleOutput.Credentials.SecretAccessKey,
 					*roleOutput.Credentials.SessionToken,
 				)),
 			),
+			awsConfig.WithRegion(awscfg.Region),
 		)
 		if err != nil {
 			return "", fmt.Errorf("could not load AWS default config: %w", err)

At the moment I don't have the time to test this, but I'll try to provide a proper fix sometime.