The extension supports AWS RDS/Aurora IAM-based authentication, allowing connections without static passwords by generating temporary tokens via the AWS SDK.
Requirements
- RDS instance with IAM database authentication enabled.
- IAM user/role with
rds-db:connect permission. - AWS credentials configured (via
AWS_PROFILE, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, or IAM role).
Usage
Create a Postgres secret with AWS_RDS_IAM_AUTH_ENABLED set to TRUE, then ATTACH using that secret.
Secret Parameters
| Parameter | Type | Required | Description |
|---|
HOST | VARCHAR | Yes | RDS/Aurora instance hostname |
PORT | VARCHAR | Yes | RDS/Aurora instance port (typically 5432) |
USER | VARCHAR | Yes | IAM database username |
AWS_RDS_IAM_AUTH_ENABLED | BOOLEAN | Yes | Enable RDS IAM authentication |
AWS_RDS_IAM_TOKEN_EXPIRATION_SECONDS | BIGINT | No | Token expiration in seconds (default: 900) |
AWS_REGION | VARCHAR | Yes | AWS region |
Implementation Details
- Token Caching: To minimize AWS SDK calls, the extension caches tokens for
AWS_RDS_IAM_TOKEN_EXPIRATION_SECONDS - 60 seconds. - Credentials: Uses the default AWS SDK credential provider chain; these are not currently configurable.
CREATE SECRET rds_secret (
TYPE POSTGRES,
HOST 'my-db-instance.xxxxxx.us-west-2.rds.amazonaws.com',
PORT '5432',
USER 'my_iam_user',
DATABASE 'postgres',
SSLMODE 'require',
AWS_RDS_IAM_AUTH_ENABLED TRUE,
AWS_REGION 'us-west-2'
);
ATTACH '' AS rds_db (TYPE POSTGRES, SECRET rds_secret);