p0 aws rds

Generate RDS database authentication tokens for PostgreSQL and MySQL through P0 just-in-time access.

Overview

Request just-in-time access to an Amazon RDS database and generate an IAM authentication token in a single command.

• Request access to a PostgreSQL or MySQL role through P0.

• Wait for approval and provisioning automatically.

• Authenticate to AWS and generate an RDS IAM authentication token.

• Output connection instructions for psql (PostgreSQL) or mysql (MySQL).

Prerequisites

• Logged-in user: Run p0 login <org> first.

• AWS CLI installed: The command uses aws rds generate-db-auth-token under the hood.

• PostgreSQL or MySQL integration installed: Your P0 administrator must have installed the PostgreSQL or MySQL integration with an RDS database.

• IAM authentication enabled: The target RDS instance must have IAM database authentication enabled.

• Network access: Your environment must have network access to the RDS instance (for example, through AWS CloudShell or a VPN).

Syntax

p0 aws [options] rds generate-db-auth-token --arch <arch> --role <role> [--instance <id>] [--database <name>]

Arguments

This command has no positional arguments. All parameters are specified as options.

Options

Option	Type	Required	Description
--arch <type>	string	Yes	Database architecture: postgres or mysql. Use mysql for MariaDB.
--role <name>	string	Yes	Database role to request access to
--instance <id>	string	No	P0 instance identifier. Required if multiple instances are configured.
--database <name>	string	No	Database name to connect to. Defaults to the instance's configured default database.
--account <id>	string	No	AWS account ID or alias. Required if P0 is installed on multiple AWS accounts.
--debug	boolean	No	Print debug information

You can set the P0_AWS_ACCOUNT environment variable instead of using --account for every command.

Output

When run in an interactive terminal, the command prints connection instructions including the generated authentication token. The instructions vary based on the --arch value:

PostgreSQL output:

export PGPASSWORD="<generated-token>"

psql "host=${RDS_HOST} port=5432 sslmode=verify-full sslrootcert=${RDS_SSL_CA} dbname=<database> user=p0_<your_username>"

MySQL output:

export MYSQL_PWD="<generated-token>"

mysql -h ${RDS_HOST} --ssl-ca=${RDS_SSL_CA} --ssl-verify-server-cert -P 3306 -u p0_<your_username> <database>

When piped or used in a non-interactive context, the command outputs only the raw authentication token.

P0 adds the p0_ prefix to the username to create a dedicated database user for your identity.

Examples

Generate a PostgreSQL authentication token

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role analyst \
  --account 123456789012

Requests the analyst role, waits for approval, and outputs psql connection instructions with the generated token.

Connect to a specific database and instance

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role readwrite \
  --instance my-prod-db \
  --database app_production

Generate a MySQL authentication token

p0 aws rds generate-db-auth-token \
  --arch mysql \
  --role developer \
  --account 123456789012

Connect from AWS CloudShell

AWS CloudShell includes the RDS SSL certificate authority at /certs/global-bundle.pem and has network access to RDS instances in the same account:

export RDS_SSL_CA='/certs/global-bundle.pem'
export RDS_HOST='my-instance.abcdef.us-east-1.rds.amazonaws.com'

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role analyst \
  --account 123456789012

Follow the output instructions to set PGPASSWORD and connect with psql.

If you are not using CloudShell, download the RDS SSL certificate authority from the AWS documentation and set RDS_SSL_CA to the local path.

How it works

1. P0 authentication: Validates your P0 session (prompts for login if expired).

2. Access request: Creates a P0 access request for the specified database role and waits for approval.

3. AWS authentication: Obtains temporary AWS credentials through Okta SAML federation or AWS Identity Center, depending on your account configuration.

4. Token generation: Calls aws rds generate-db-auth-token with the temporary credentials to produce an IAM authentication token.

5. Connection instructions: Outputs the token and database-specific connection instructions.

RDS IAM authentication tokens are valid for 15 minutes. Generate a new token if your connection attempt fails after that window.

Error messages

Error	Cause	Solution
Did not receive access ID from server	Access request failed or was denied	Check your notification channel for request status
P0 granted access, but <instance> is not a RDS instance.	The instance is not configured as an RDS database	Verify the instance identifier with your P0 administrator
No instance with ID <id>	Instance not found or not installed	Check available instances with p0 ls or contact your administrator
Could not identify principal for this access.	Email address could not be parsed	Verify your P0 account email address is correctly configured

Related commands

• p0 request - Request access without generating credentials

• p0 aws role assume - Assume an AWS IAM role through Okta SAML

• p0 aws permission-set assume - Assume an AWS permission set through Identity Center

• p0 login - Authenticate with P0

• p0 ls - List available resources

Related documentation

• PostgreSQL integration - Configure P0 for PostgreSQL

• MySQL integration - Configure P0 for MySQL

• Installing an RDS database - Set up RDS with P0

• Requesting PostgreSQL access - All methods for requesting database access