Blog

Reaching a private RDS PostgreSQL instance from a developer laptop with no static password, no bastion login, and no VPN. Combines AWS SSM Session Manager port forwarding to a headless target with IAM Database Authentication, where the IAM token replaces the DB password. Covers the Terraform to enable iam_database_authentication on the RDS instance and the SQL grants to bind IAM identities to Postgres roles.