AWS IAM Database Authentication for RDS and Aurora

1. App requests an auth token from AWS STS (15-minute TTL)
2. App connects to RDS using the token as the password
3. RDS validates the token against IAM
4. No passwords stored — access controlled via IAM policies

aws rds modify-db-instance \
  --db-instance-identifier my-db \
  --enable-iam-database-authentication \
  --apply-immediately

-- PostgreSQL
CREATE USER iam_app WITH LOGIN;
GRANT rds_iam TO iam_app;

-- MySQL
CREATE USER 'iam_app'@'%' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';
GRANT SELECT, INSERT, UPDATE ON mydb.* TO 'iam_app'@'%';

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "rds-db:connect",
    "Resource": "arn:aws:rds-db:us-east-1:123456789:dbuser:db-XXXX/iam_app"
  }]
}

import boto3

client = boto3.client('rds', region_name='us-east-1')
token = client.generate_db_auth_token(
    DBHostname='my-db.cluster-xyz.us-east-1.rds.amazonaws.com',
    Port=5432,
    DBUsername='iam_app'
)

# Use token as password in psycopg2 / SQLAlchemy connection string
# Token expires in 15 minutes — regenerate before expiry

export PGPASSWORD=$(aws rds generate-db-auth-token \
  --hostname my-db.cluster-xyz.us-east-1.rds.amazonaws.com \
  --port 5432 \
  --username iam_app \
  --region us-east-1)

psql "host=my-db... dbname=mydb user=iam_app sslmode=require"