Reset script for AWS RDS Master user

[sysadmin-z]

Hey,

 

I would like to request a reset script for AWS RDS Master user passwords. I am currently in a situation where I restore an RDS snapshot to a specific environment and then try to update the master user through the API. However, since the user is configured for password resets, updating the password actually performs a reset instead of simply updating the password field. Since the password stored for the refreshed environment user does not match the user that was restored, the reset attempt fails. This could be remedied by not allowing resets on this user but this user is a privileged user which resets other user passwords for the newly restored environment.

 

Another solution would be to allow users that are configured for password resets which have their password updated through the API to not trigger a reset. Simply, set the password field to what was supplied.

 

I realize that I quickly threw this together. Please let me know if you need any other information.

[support]

Hello,

Thanks for your request. Unfortunately we do not really have much in the way of experience with AWS RDS, so it may take us some time to learn what's required here. The only current way to prevent a reset as you've mentioned is to uncheck the option 'Enabled for Resets', but understand this is not ideal with your workflow.

Regards

Click Studios

[sysadmin-z]

Sorry to take so long to reply to this. There are powershell cmdlets for AWS:

https://docs.aws.amazon.com/powershell/latest/userguide/pstools-welcome.html

 

There should be an option to reset RDS master password. I am going to attempt to write this script for myself. Could you point me in the right direction to any documentation regarding custom password reset scripts?

 

Thanks.

[support]

Hello,

 

We have a little information in our User Manual for this, under the Help Menu. If you have a look in the KB Articles section, you will find the detail below.

 

With our scripts, the majority of them are error capturing, where we try and consider all possible scenarios when a reset might fail. What I would suggest is having a look at all our scripts in the folder C:\inetpub\Passwordstate\setup\scripts, and take a copy of one in which you can test this outside of Passwordstate.

If AWS cmdlets return some sort of success message, and hopefully they should, the in the script you return Write-Output "Success"

 

And for failures, you simply return something like Write-Output "Failed to execute script correctly against , which you will see in all our scripts.

 

If you have any further questions about this, please let us know as it would be great if you could get a script working for this - we'll do whatever we can do to help.
 

 

Regards

Click Studios