Amazon RDS Connection

1

Enable IAM authentication on your RDS instance

In the AWS Console, go to RDS → Databases → Your Instance → Modify and enable IAM database authentication.

# Using AWS CLI
aws rds modify-db-instance \
  --db-instance-identifier your-instance \
  --enable-iam-database-authentication \
  --apply-immediately

2

Create an IAM policy

Create an IAM policy that grants the rds-db:connect permission for your database user.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "rds-db:connect",
      "Resource": "arn:aws:rds-db:REGION:ACCOUNT_ID:dbuser:DBI_RESOURCE_ID/forcecnx_reader"
    }
  ]
}

Replace REGION, ACCOUNT_ID, and DBI_RESOURCE_ID with your values. The resource ID is found on the RDS instance's Configuration tab.

3

Create an IAM user and attach the policy

Create a dedicated IAM user for ForceCnx and attach the policy from the previous step. Generate an access key pair.

aws iam create-user --user-name forcecnx-rds-reader
aws iam attach-user-policy \
  --user-name forcecnx-rds-reader \
  --policy-arn arn:aws:iam::ACCOUNT_ID:policy/ForceCnxRDSConnect
aws iam create-access-key --user-name forcecnx-rds-reader

Save the AccessKeyId and SecretAccessKey from the output.

4

Create the database user

Connect to your RDS instance and create a PostgreSQL user that maps to the IAM identity:

-- Create an IAM-authenticated database user
CREATE USER forcecnx_reader WITH LOGIN;
GRANT rds_iam TO forcecnx_reader;

-- Grant read access
GRANT USAGE ON SCHEMA public TO forcecnx_reader;
GRANT SELECT ON TABLE customers, orders TO forcecnx_reader;

5

Open the New Connection form

From your ForceCnx Dashboard, click + New Connection and select the AWS RDS tab.

6

Enter connection details

Fill in your RDS connection parameters:

Field	Description	Example
Endpoint	RDS instance endpoint	my-db.abc123.us-east-1.rds.amazonaws.com
Port	PostgreSQL port	5432
Region	AWS region	us-east-1
Database	Database name	myapp
Username	Database user	forcecnx_reader
Use IAM Auth	Enable for IAM database authentication	Checked
Access Key ID	IAM user access key	—
Secret Access Key	IAM user secret key	—

If not using IAM auth, provide a standard database password instead of access keys.

7

Test and save

Click Create Connection. ForceCnx will connect to your RDS instance and introspect the schema.