HikariCP - Amazon IAM Authentication - Need of evicting existing connection in Pool? - postgresql

Question

I am using IAM authentication to connect to Amazon RDS. Since the password gets expired every 15 minutes, I am using HikariConfigMXBean to update the credentials every 14 minutes (1 minute before the auth-token actually expires).
I have been referring codes from other folks, and I have seen people doing softEvictConnections() after refreshing the credentials.
As per the documentation, softEvictConnections() will basically remove all preexisting connections and create a new pool of connections using fresh credentials.
When I tried to test, I am able to verify that the older connection created with old auth-token (which has now expired) continues to work.
For reference, below is the piece of code:
void updateHikariCredentials(HikariDataSource dataSource, String userName, String password)
{
// Update username & password.
HikariConfigMXBean configBean = dataSource.getHikariConfigMXBean();
configBean.setUsername(userName);
configBean.setPassword(password);
HikariPoolMXBean pool = dataSource.getHikariPoolMXBean();
if (pool != null) {
pool.softEvictConnections(); // <-- Why is this needed?
}
}
I am trying to understand, what is the need of evicting the existing connections?
I already set maxConnectionAge for my connections. Is there any additional advantage of forcefully evicting old connection on password update, which I am missing?

Answer 1

I am trying to understand, what is the need of evicting the existing connections? [...] Is there any additional advantage of forcefully evicting old connection on password update, which I am missing?
There isn't
Authentication happens when the database connection is established. Once established, the connection is not re-authenticated. By throwing away all established connections, you're just adding overhead.
The goal of short-lived credentials is to prevent an attacker from exfiltrating credentials and then using them to open a connection. If they manage to open that connection during the time that the credentials are valid, there's nothing you can do to stop them accessing your data short of manually killing the back-end process.