Connecting to a database through RDS Proxy (original) (raw)

The way to connect to an RDS DB instance through a proxy or by connecting to the database is generally the same. For more information, see Overview of proxy endpoints.

Topics

Connecting to a proxy using native authentication

Use the following steps to connect to a proxy using native authentication:

  1. Find the proxy endpoint. In the AWS Management Console, you can find the endpoint on the details page for the corresponding proxy. With the AWS CLI, you can use thedescribe-db-proxies command. The following example shows how.
# Add --output text to get output as a simple tab-separated list.  
$ aws rds describe-db-proxies --query '*[*].{DBProxyName:DBProxyName,Endpoint:Endpoint}'  
[  
    [  
        {  
            "Endpoint": "the-proxy.proxy-demo.us-east-1.rds.amazonaws.com",  
            "DBProxyName": "the-proxy"  
        },  
        {  
            "Endpoint": "the-proxy-other-secret.proxy-demo.us-east-1.rds.amazonaws.com",  
            "DBProxyName": "the-proxy-other-secret"  
        },  
        {  
            "Endpoint": "the-proxy-rds-secret.proxy-demo.us-east-1.rds.amazonaws.com",  
            "DBProxyName": "the-proxy-rds-secret"  
        },  
        {  
            "Endpoint": "the-proxy-t3.proxy-demo.us-east-1.rds.amazonaws.com",  
            "DBProxyName": "the-proxy-t3"  
        }  
    ]  
]
  1. Specify the endpoint as the host parameter in the connection string for your client application. For example, specify the proxy endpoint as the value for the mysql -h option or psql -h option.
  2. Supply the same database user name and password as you usually do.

Connecting to a proxy using IAM authentication

When you use IAM authentication with RDS Proxy, set up your database users to authenticate with regular user names and passwords. The IAM authentication applies to RDS Proxy retrieving the user name and password credentials from Secrets Manager. The connection from RDS Proxy to the underlying database doesn't go through IAM.

To connect to RDS Proxy using IAM authentication, use the same general connection procedure as for IAM authentication with an RDS DB instance. For general information about using IAM, see Security in Amazon RDS.

The major differences in IAM usage for RDS Proxy include the following:

You can grant a specific user access to the proxy by modifying the IAM policy. An example follows.

"Resource": "arn:aws:rds-db:us-east-2:1234567890:dbuser:prx-ABCDEFGHIJKL01234/db_user"

Considerations for connecting to a proxy with Microsoft SQL Server

For connecting to a proxy using IAM authentication, you don't use the password field. Instead, you provide the appropriate token property for each type of database driver in the token field. For example, use the accessToken property for JDBC, or the sql_copt_ss_access_token property for ODBC. Or use theAccessToken property for the .NET SqlClient driver. You can't use IAM authentication with clients that don't support token properties.

Under some conditions, a proxy can't share a database connection and instead pins the connection from your client application to the proxy to a dedicated database connection. For more information about these conditions, see Avoiding pinning an RDS Proxy.

Considerations for connecting to a proxy with PostgreSQL

If you create a new PostgreSQL database user for connecting to RDS Proxy, make sure that you grant the user CONNECT privilege on the database. Without this, the user can't establish a connection. For more information, see Adding a new database user to a PostgreSQL database when using RDS Proxy.

When a client starts a connection to a PostgreSQL database, it sends a startup message. This message includes pairs of parameter name and value strings. For details, see the StartupMessage in PostgreSQL message formats in the PostgreSQL documentation.

When you connect through an RDS proxy, the startup message can include the following currently recognized parameters:

The startup message can also include the following additional runtime parameters:

For more information about PostgreSQL messaging, see the Frontend/Backend protocol in the PostgreSQL documentation.

For PostgreSQL, if you use JDBC, we recommend the following to avoid pinning:

For more information, see Avoiding pinning an RDS Proxy. For more information about connecting using JDBC, seeConnecting to the database in the PostgreSQL documentation.