Connect to RDS and Aurora without Database Passwords

Connect to RDS, Aurora, and Redshift using IAM database authentication

IAM database authentication (opens in new tab) replaces static database passwords with short-lived tokens generated from IAM credentials – with Vouch, hardware-backed ones.

RDS / Aurora PostgreSQL

vouch exec --type rds \
  --rds-hostname mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  --rds-username mydbuser \
  -- psql -d mydb

eval "$(vouch env --type rds \
  --rds-hostname mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  --rds-username mydbuser)"
psql -d mydb

TOKEN=$(vouch credential rds \
  --hostname mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  --username mydbuser)

# Generate an IAM auth token (valid for 15 minutes)
TOKEN=$(aws rds generate-db-auth-token \
  --hostname mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  --port 5432 \
  --username mydbuser \
  --profile vouch)

# Connect with psql
PGPASSWORD="$TOKEN" psql \
  -h mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  -p 5432 \
  -U mydbuser \
  -d mydb \
  "sslmode=require"

Database setup: grant the PostgreSQL user the rds_iam role:

GRANT rds_iam TO mydbuser;

RDS / Aurora MySQL

MySQL requires --enable-cleartext-plugin because the IAM token is sent as a cleartext password over TLS.

TOKEN=$(vouch credential rds \
  --hostname mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  --username mydbuser \
  --port 3306)

mysql -h mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  -P 3306 \
  -u mydbuser \
  --password="$TOKEN" \
  --ssl-mode=REQUIRED \
  --enable-cleartext-plugin

# Generate an IAM auth token
TOKEN=$(aws rds generate-db-auth-token \
  --hostname mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  --port 3306 \
  --username mydbuser \
  --profile vouch)

# Connect with mysql (note: --enable-cleartext-plugin is required)
mysql -h mydb.cluster-abc123.us-east-1.rds.amazonaws.com \
  -P 3306 \
  -u mydbuser \
  --password="$TOKEN" \
  --ssl-mode=REQUIRED \
  --enable-cleartext-plugin

Database setup: Create the user with the AWSAuthenticationPlugin:

CREATE USER 'mydbuser'@'%' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';

Amazon Redshift

Redshift issues temporary credentials with a configurable lifetime (15–60 minutes); Vouch supports provisioned clusters and Redshift Serverless workgroups.

Using Vouch CLI (provisioned cluster)

vouch exec generates credentials and injects PostgreSQL environment variables (PGPASSWORD, PGUSER, PGSSLMODE=require) automatically:

vouch exec --type redshift \
  --redshift-cluster-id my-cluster \
  --redshift-db-name mydb \
  -- psql -h my-cluster.abc123.us-east-1.redshift.amazonaws.com -p 5439

Or set them in your current shell:

eval "$(vouch env --type redshift \
  --redshift-cluster-id my-cluster \
  --redshift-db-name mydb)"
psql -h my-cluster.abc123.us-east-1.redshift.amazonaws.com -p 5439

To generate just the credentials:

vouch credential redshift --cluster-id my-cluster --db-name mydb

The --duration flag controls credential lifetime for provisioned clusters (900–3600 seconds, default: 900):

vouch credential redshift --cluster-id my-cluster --duration 3600

Using Vouch CLI (Redshift Serverless)

vouch exec --type redshift \
  --redshift-workgroup my-workgroup \
  --redshift-db-name mydb \
  -- psql -h my-workgroup.123456789012.us-east-1.redshift-serverless.amazonaws.com -p 5439

Or generate credentials directly:

vouch credential redshift --workgroup my-workgroup --db-name mydb

Using AWS CLI

# Get temporary Redshift credentials
CREDS=$(aws redshift get-cluster-credentials \
  --cluster-identifier my-cluster \
  --db-user mydbuser \
  --db-name mydb \
  --duration-seconds 3600 \
  --profile vouch)

# Extract and connect
DB_USER=$(echo "$CREDS" | jq -r '.DbUser')
DB_PASS=$(echo "$CREDS" | jq -r '.DbPassword')

PGPASSWORD="$DB_PASS" psql \
  -h my-cluster.abc123.us-east-1.redshift.amazonaws.com \
  -p 5439 \
  -U "$DB_USER" \
  -d mydb

Required IAM permissions

Your Vouch IAM role needs permission to generate database auth tokens and credentials.

RDS / Aurora:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "rds-db:connect",
      "Resource": "arn:aws:rds-db:us-east-1:123456789012:dbuser:cluster-ABC123/mydbuser"
    }
  ]
}

Redshift (provisioned clusters):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "redshift:GetClusterCredentialsWithIAM",
      "Resource": "arn:aws:redshift:us-east-1:123456789012:dbname:my-cluster/*"
    }
  ]
}

Redshift Serverless:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "redshift-serverless:GetCredentials",
      "Resource": "arn:aws:redshift-serverless:us-east-1:123456789012:workgroup/*"
    }
  ]
}

How it works

1. vouch login – The developer authenticates with their YubiKey.
2. vouch credential rds or vouch credential redshift – Vouch generates a short-lived auth token or temporary credentials.
3. Database client – The token is passed as the password to psql, mysql, or another client; vouch exec handles this automatically.

vouch login → vouch credential rds|redshift → database client
vouch login → vouch exec --type rds|redshift -- psql

Troubleshooting

“PAM authentication failed for user”

Ensure IAM database authentication is enabled on the RDS instance and the database user has the rds_iam role (PostgreSQL) or was created with AWSAuthenticationPlugin (MySQL).

Token expired

RDS/Aurora auth tokens are valid for 15 minutes. Generate a fresh token before connecting. The token is only used to establish the connection – active sessions are not affected by expiry.

SSL required error

IAM database authentication requires SSL/TLS. Use sslmode=require for PostgreSQL or --ssl-mode=REQUIRED for MySQL.