How to Connect to Amazon RDS Using IAM Authentication with AWS CLI

The RDS instance refused to connect. It wasn’t the database. It wasn’t the network. It was IAM.

AWS CLI can connect to an Amazon RDS database using IAM authentication, but the steps demand precision. Miss one flag or misplace one token and you’re locked out. This guide walks through the exact process to generate an IAM auth token and connect to RDS from the AWS CLI, without skipping the details that matter.

Why Use IAM Authentication for RDS

IAM authentication replaces static passwords with short-lived tokens. No credentials stored in code or configuration. Access is granted through policies, not shared secrets. Security teams like it. Developers like the simplicity once it’s set up.

Prerequisites

AWS CLI configured with an IAM user or role that has rds-db:connect permissions
The RDS instance set to allow IAM authentication (--enable-iam-database-authentication)
A DB user created with the same name as your IAM username or matching an allowed IAM role

Step 1: Generate an IAM Auth Token

Use the AWS CLI to create the token. Replace the placeholders with your region, host, port, and username.

aws rds generate-db-auth-token \
 --hostname your-db-endpoint.rds.amazonaws.com \
 --port 3306 \
 --region us-east-1 \
 --username db_user

This command outputs a token valid for 15 minutes.

Continue reading? Get the full guide.

AWS IAM Policies + CLI Authentication Patterns: Architecture Patterns & Best Practices

Free. No spam. Unsubscribe anytime.

Step 2: Connect Using the Token

For MySQL:

mysql \
 --host=your-db-endpoint.rds.amazonaws.com \
 --port=3306 \
 --ssl-ca=/path/to/rds-combined-ca-bundle.pem \
 --enable-cleartext-plugin \
 --user=db_user \
 --password='THE_GENERATED_TOKEN'

For PostgreSQL:

PGPASSWORD='THE_GENERATED_TOKEN' psql \
 "host=your-db-endpoint.rds.amazonaws.com \
   port=5432 \
   sslmode=verify-full \
   sslrootcert=/path/to/rds-combined-ca-bundle.pem \
   user=db_user \
   dbname=yourdb"

Step 3: Set and Test Permissions

IAM policies must match the target RDS instance. Example policy statement:

{
 "Effect": "Allow",
 "Action": "rds-db:connect",
 "Resource": "arn:aws:rds-db:us-east-1:123456789012:dbuser:db-ABCDEFG12345/db_user"
}

Test your connection immediately. The token expires fast.

Notes on Security and Reliability

Rotate IAM roles and keep policies scoped tightly
Use SSL to avoid unencrypted credentials over the network
Automate token generation in scripts or CI pipelines for consistent deployments

AWS CLI with RDS IAM authentication is a secure way to connect, but also a fast way to break access if done carelessly. Get it right, and you remove a major class of password risks.

You can try this without touching your production environment. Spin it up, see the IAM connection in action, and prove the flow to your team in minutes with hoop.dev. It’s live, fast, and secure—ready for your next RDS integration.