Fix matcher AssumeRoleARN not applied to DiscoveryResourceChecker

lib/srv/db/access_test.go

@@ -2999,14 +2999,16 @@ func withAzureRedis(name string, token string) withDatabaseOption {
 }
 
 type fakeDiscoveryResourceChecker struct {
-	errorsByName map[string]error
+	byName map[string]func(context.Context, types.Database) error
 }
 
-func (f *fakeDiscoveryResourceChecker) Check(_ context.Context, database types.Database) error {
-	if len(f.errorsByName) == 0 {
-		return nil
+func (f *fakeDiscoveryResourceChecker) Check(ctx context.Context, database types.Database) error {
+	if len(f.byName) > 0 {
+		if check := f.byName[database.GetName()]; check != nil {
+			return trace.Wrap(check(ctx, database))
+		}
 	}
-	return trace.Wrap(f.errorsByName[database.GetName()])
+	return nil
 }
 
 var dynamicLabels = types.LabelsToV2(map[string]types.CommandLabel{

lib/srv/db/watcher.go

@@ -162,17 +162,19 @@ func (s *Server) onCreate(ctx context.Context, resource types.ResourceWithLabels
 		return trace.BadParameter("expected types.Database, got %T", resource)
 	}
 
-	if s.monitoredDatabases.isDiscoveryResource(database) {
-		if err := s.cfg.discoveryResourceChecker.Check(ctx, database); err != nil {
-			return trace.Wrap(err)
-		}
-	}
-
 	// OnCreate receives a "new" resource from s.monitoredDatabases. Make a
 	// copy here so that any attribute changes to the proxied database will not
 	// affect database objects tracked in s.monitoredDatabases.
 	databaseCopy := database.Copy()
 	applyResourceMatchersToDatabase(databaseCopy, s.cfg.ResourceMatchers)
+
+	// Run DiscoveryResourceChecker after resource matchers are applied to make
+	// sure the correct AssumeRoleARN is used.
+	if s.monitoredDatabases.isDiscoveryResource(database) {
+		if err := s.cfg.discoveryResourceChecker.Check(ctx, databaseCopy); err != nil {
+			return trace.Wrap(err)
+		}
+	}
 	return s.registerDatabase(ctx, databaseCopy)
 }
 

lib/srv/db/watcher_test.go

@@ -165,8 +165,20 @@ func TestWatcherDynamicResource(t *testing.T) {
 			reconcileCh <- d
 		},
 		DiscoveryResourceChecker: &fakeDiscoveryResourceChecker{
-			errorsByName: map[string]error{
-				"db-fail-check": trace.BadParameter("bad db"),
+			byName: map[string]func(context.Context, types.Database) error{
+				"db-fail-check": func(context.Context, types.Database) error {
+					return trace.BadParameter("bad db")
+				},
+				"db5": func(_ context.Context, db types.Database) error {
+					// Validate AssumeRoleARN and ExternalID matches above
+					// services.ResourceMatcherAWS,
+					meta := db.GetAWS()
+					if meta.AssumeRoleARN != "arn:aws:iam::123456789012:role/DBAccess" ||
+						meta.ExternalID != "external-id" {
+						return trace.CompareFailed("AssumeRoleARN/ExternalID does not match")
+					}
+					return nil
+				},
 			},
 		},
 	})
@@ -233,7 +245,7 @@ func TestWatcherDynamicResource(t *testing.T) {
 		// ResourceMatchers and has AssumeRoleARN set by the discovery service.
 		discoveredDB5, err := makeDiscoveryDatabase("db5", map[string]string{"group": "b"}, withRDSURL, withDiscoveryAssumeRoleARN)
 		require.NoError(t, err)
-		require.True(t, db4.IsRDS())
+		require.True(t, discoveredDB5.IsRDS())
 
 		err = testCtx.authServer.CreateDatabase(ctx, discoveredDB5)
 		require.NoError(t, err)