My top-level goal is to enable two-user (zero-downtime) secret rotation for RDS users. To recap/summarize the approach, you always have two accounts in your DB that have equivalent access. You switch which one is active/deprecated every N days, and every time you switch one of these accounts to active, you update the password. This way, clients have plenty of time to drain off of the inactive username/password.
This does require you to maintain two accounts with equivalent access, though. It occurred to me that MySQL has a very nice feature baked in - proxy users! This allows us to maintain 1 real account (which has all the grants), and 2 proxy users we can switch between (which only have a proxy grant each). The proxy accounts inherit access from the real account. This is, in theory, way easier to maintain.
The problem is getting the check_user_proxy and mysql_native_password_proxy_users values to actually apply. I have:
Created a non-default DB Cluster Parameter Group with these settings turned on. Set my existing cluster (Serverless Aurora MySQL 5.7) to use these parameters (value=1). Waited for the DB state to return from "Modifying" to "Active". Exited my DB client and reconnected. Attempted to use proxy access (log in as proxy user, attempt to SELECT from tables, check @@proxy_user). Logged in as root, to troubleshoot with SELECT @@check_proxy_users (got 0). I'm scratching my head a little at what I'm doing wrong, or if what I'm trying to do is just impossible/a bad idea (if it is, that'd be nice to know too). It's impossible to find help via web search, since all the results are for RDS Proxy (cool but entirely unrelated), so hopefully this question will be findable for anyone in the future who hits the same problem.
(Migrated from https://stackoverflow.com/posts/68166550 per top comment)
