Describe the bug

When setting up Kerberos authentication for an Instance, the arguments domain and domainRole can be provided. Here, if domainRole is undefined, a default IAM role is created, but using that role results in the failure of the Instance creation.

Expected Behavior

The instance is successfully deployed.

Current Behavior

The deployment of the Instance fails as follows.

instance-kerberos | 3:55:29 AM | CREATE_FAILED        | AWS::RDS::DBInstance                        | Database (DatabaseB269D8BB) Resource handler returned message: "IAM role provided is not valid, please check that the role exists and has the correct policies (Service: Rds, Status Code: 400, Request ID: 8c7fcae7-6b35-4689-a6e8-4882d7c330b0)" (RequestToken: 724c9cf1-a9a0-9f26-345d-0434f73c3d3d, HandlerErrorCode: InvalidRequest)

Reproduction Steps

By deploying the following code, the error can be reproduced.

import * as cdk from 'aws-cdk-lib/core';
import * as integ from '@aws-cdk/integ-tests-alpha';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as rds from 'aws-cdk-lib/aws-rds';

const app = new cdk.App();

const stack = new cdk.Stack(app, 'instance-kerberos');
const vpc = new ec2.Vpc(stack, 'VPC');

new rds.DatabaseInstance(stack, 'Database', {
  engine: rds.DatabaseInstanceEngine.mysql({
    version: rds.MysqlEngineVersion.VER_8_0_35,
  }),
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MEDIUM),
  vpc,
  domain: 'd-12345678',
});

Possible Solution

Add directoryservice.rds.amazonaws.com as a principal in the assume role.

Additional Information/Context

No response

CDK CLI Version

2.116.1

Framework Version

No response

Node.js Version

v20.10.0

OS

irreable

Language

TypeScript

Language Version

No response

Other information

No response