Deployments were locked. The database would not connect. Logs pointed to one culprit: IAM roles missing the right trust policy for RDS access. The app was healthy. The servers were fine. But the delivery pipeline was dead because AWS RDS and IAM were out of sync.
This is the nightmare nobody talks about. Delivery pipelines often fail at the invisible seams—permission chains, role assumptions, and policy scopes. If you run AWS RDS in production, and your deployments push to it automatically, a clean IAM connection is not optional. Without it, every environment is a timed bomb.
The fastest delivery pipelines in AWS treat IAM as part of the application. That means defining roles for RDS at the same time you define build specs. It means managing least privilege without killing flexibility. It means every push knows exactly who it can be when touching the database.
A solid pattern starts in your CI/CD config. Set up an IAM Role with permission to connect to RDS using rds-db:connect. Attach this to your build job with a trust policy to allow your pipeline’s principal service. Avoid inline policies buried in console clicks—use code. Use AWS CLI or IaC tools like CloudFormation or Terraform so each step is explicit, versioned, and reviewable.