Now letвЂ™s talk about the steps to configure IAM autentication correctly on an Amazon RDS MySQL database instance. If you run SQL Server or Oracle on RDS, unfortunately you cannot use this feature with those database engines. We can discuss that method in other blog posts as well.Д«y the way, currently IAM authentication is supported only on MySQL and PostgreSQL databases. If you need more connections, using Amazon RDS integration with AWS Secrets Manager would be more appropriate. You may have scalability problems, because the number of connections is limited to 256 connections per second when you use this method. So you manage your DB credentials along with others on IAM, in a single platform.Д«ut using IAM authentication on RDS is not perfect. You can define a user on your database and associate it with an IAM policy and attach this policy to the IAM roles that need the same level of permissions. IAM is the central unit of authentication and access management on AWS. Considering this to keeping the credentials in an environment variable which you do not rotate often, it is no brainer that this method is more secure. When you create an IAM role for your AWS Lambda function, it rotates its credentials automatically in small intervals. The reason to enable and use IAM authentication on Amazon RDS is because it is the most secure method in theory. Why Use IAM Authentication on Amazon RDS? I will use an Amazon RDS - MySQL DB instance, but IAM authentication is also supported on PostgreSQL DB instances as well.

In this post, I will talk about one of the most secure methods, using IAM authentication of Amazon RDS, with an example of an AWS Lambda function developed in Python. Yes, there are different ways to manage your database credentials in your AWS Lambda functions. Where do you keep your DB credentials in your AWS Lambda functions that you use to access your Amazon RDS databases? Hardcoded? No! Environment variables? Well, you might be using AWS Secrets Manager, right? It would be great! But did you know that you can also use the IAM role of your AWS Lambda function and its temporary credentials to do this?

Aws lambda python encrypto