Blog

Reaching a private RDS PostgreSQL instance from a developer laptop with no static password, no bastion login, and no VPN. Combines AWS SSM Session Manager port forwarding to a headless target with IAM Database Authentication, where the IAM token replaces the DB password. Covers the Terraform to enable iam_database_authentication on the RDS instance and the SQL grants to bind IAM identities to Postgres roles.

Practical VPN setups across cloud platforms: OpenVPN with AWS VPN Gateway, Azure VPN Gateway, and Debian 12, an OpenVPN client on a GitHub Actions macOS runner, WireGuard between cloud infrastructure and clients, and a FortiGate scenario.