IAM Authentication to RDS from Lambda (NodeJS) - authentication

Question

I'm a bit lost as to what could be wrong here. I have been following this set of instructions to get my Lambdas to connect to RDS using IAM Authentication according to these instructions:
https://cloudonaut.io/passwordless-database-authentication-for-aws-lambda/
Now, I have checked that my RDS Cluster indeed has IAM Authentication enabled - I have created the user and granted all permissions necessary (done this a few times) and I have verified that the "Signer" step here does, indeed, generate a token that's supposedly valid.
Furthermore, the lambdas have the permissions for rds-db:connect and I even added RDS full access for the lambda role (altho I reckon this shouldn't be necessary).
Still, when I attempt to connect, I simply get this:
"errorType": "Error",
"errorMessage": "Access denied for user 'mydbuser'#'19.196.193.217' (using password: YES)",
"code": "ER_ACCESS_DENIED_ERROR",
"errno": 1045,
"sqlState": "28000",
"sqlMessage": "Access denied for user 'mydbuser'#'19.196.193.217' (using password: YES)",
I also noticed that the token I get back has some URL encoded bits so I tried URL decoding it, but that didn't lead anywhere.
I'm out of ideas as to where this could even be failing and the error messages are utterly unhelpful. The grants on the user in question are:
GRANT USAGE ON *.* TO 'mydbuser'#'%'
GRANT ALL PRIVILEGES ON `mydbuser`.* TO 'mydbuser'#'%'
So this hints at it not accepting the token as password. My connection code looks like this:
const mysql = require('mysql2');
...
signer.getAuthToken({
region: 'my+region',
hostname: process.env.ENDPOINT,
port: 3306,
username: 'mydbuser'
}, function(err, token) {
var connection = mysql.createConnection({
host: process.env.ENDPOINT,
port: 3306,
user: 'mydbuser',
password: token,
database: 'mydb',
ssl: { ca: fs.readFileSync(__dirname + '/rds-combined-ca-bundle.pem') },
authSwitchHandler: function (data, cb) {
if (data.pluginName === 'mysql_clear_password') {
cb(null, Buffer.from(token + '\0'));
}
}
});
connection.connect((res, err) => {
console.log(res, err);
});
connection.query(
`SELECT 1;`, ...
Also the full generated token does include the X-Amz-Security-Token so it hints at it being valid from what I've researched so far.
What else could even fail at this point ?