> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-cli/p0-commands-and-usage/p0-aws-rds.md).

# p0 aws rds

### Overview

Request just-in-time access to an Amazon RDS database and generate an IAM authentication token in a single command.

* Request access to a PostgreSQL or MySQL role through P0.
* Wait for approval and provisioning automatically.
* Authenticate to AWS and generate an RDS IAM authentication token.
* Output connection instructions for `psql` (PostgreSQL) or `mysql` (MySQL).

### Prerequisites

* **Logged-in user**: Run `p0 login <org>` first.
* **AWS CLI installed**: The command uses `aws rds generate-db-auth-token` under the hood.
* **PostgreSQL or MySQL integration installed**: Your P0 administrator must have installed the [PostgreSQL](https://github.com/p0-security/p0-docs/blob/main/integrations/resource-integrations/postgresql/README.md) or [MySQL](/integrations/resource-integrations/mysql.md) integration with an RDS database.
* **IAM authentication enabled**: The target RDS instance must have IAM database authentication enabled.
* **Network access**: Your environment must have network access to the RDS instance (for example, through AWS CloudShell or a VPN).

### Syntax

```
p0 aws [options] rds generate-db-auth-token --arch <arch> --role <role> [--instance <id>] [--database <name>]
```

### Arguments

This command has no positional arguments. All parameters are specified as options.

### Options

| Option              | Type    | Required | Description                                                                          |
| ------------------- | ------- | -------- | ------------------------------------------------------------------------------------ |
| `--arch <type>`     | string  | Yes      | Database architecture: `postgres` or `mysql`. Use `mysql` for MariaDB.               |
| `--role <name>`     | string  | Yes      | Database role to request access to                                                   |
| `--instance <id>`   | string  | No       | P0 instance identifier. Required if multiple instances are configured.               |
| `--database <name>` | string  | No       | Database name to connect to. Defaults to the instance's configured default database. |
| `--account <id>`    | string  | No       | AWS account ID or alias. Required if P0 is installed on multiple AWS accounts.       |
| `--debug`           | boolean | No       | Print debug information                                                              |

{% hint style="info" %}
You can set the `P0_AWS_ACCOUNT` environment variable instead of using `--account` for every command.
{% endhint %}

### Output

When run in an interactive terminal, the command prints connection instructions including the generated authentication token. The instructions vary based on the `--arch` value:

**PostgreSQL output:**

```bash
export PGPASSWORD="<generated-token>"

psql "host=${RDS_HOST} port=5432 sslmode=verify-full sslrootcert=${RDS_SSL_CA} dbname=<database> user=p0_<your_username>"
```

**MySQL output:**

```bash
export MYSQL_PWD="<generated-token>"

mysql -h ${RDS_HOST} --ssl-ca=${RDS_SSL_CA} --ssl-verify-server-cert -P 3306 -u p0_<your_username> <database>
```

When piped or used in a non-interactive context, the command outputs only the raw authentication token.

{% hint style="info" %}
P0 adds the `p0_` prefix to the username to create a dedicated database user for your identity.
{% endhint %}

### Examples

#### Generate a PostgreSQL authentication token

```bash
p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role analyst \
  --account 123456789012
```

Requests the `analyst` role, waits for approval, and outputs `psql` connection instructions with the generated token.

#### Connect to a specific database and instance

```bash
p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role readwrite \
  --instance my-prod-db \
  --database app_production
```

#### Generate a MySQL authentication token

```bash
p0 aws rds generate-db-auth-token \
  --arch mysql \
  --role developer \
  --account 123456789012
```

#### Connect from AWS CloudShell

AWS CloudShell includes the RDS SSL certificate authority at `/certs/global-bundle.pem` and has network access to RDS instances in the same account:

```bash
export RDS_SSL_CA='/certs/global-bundle.pem'
export RDS_HOST='my-instance.abcdef.us-east-1.rds.amazonaws.com'

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role analyst \
  --account 123456789012
```

Follow the output instructions to set `PGPASSWORD` and connect with `psql`.

{% hint style="info" %}
If you are not using CloudShell, download the RDS SSL certificate authority from the [AWS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html) and set `RDS_SSL_CA` to the local path.
{% endhint %}

### How it works

1. **P0 authentication**: Validates your P0 session (prompts for login if expired).
2. **Access request**: Creates a P0 access request for the specified database role and waits for approval.
3. **AWS authentication**: Obtains temporary AWS credentials through Okta SAML federation or AWS Identity Center, depending on your account configuration.
4. **Token generation**: Calls `aws rds generate-db-auth-token` with the temporary credentials to produce an IAM authentication token.
5. **Connection instructions**: Outputs the token and database-specific connection instructions.

{% hint style="warning" %}
RDS IAM authentication tokens are valid for 15 minutes. Generate a new token if your connection attempt fails after that window.
{% endhint %}

### Error messages

| Error                                                      | Cause                                             | Solution                                                             |
| ---------------------------------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------- |
| `Did not receive access ID from server`                    | Access request failed or was denied               | Check your notification channel for request status                   |
| `P0 granted access, but <instance> is not a RDS instance.` | The instance is not configured as an RDS database | Verify the instance identifier with your P0 administrator            |
| `No instance with ID <id>`                                 | Instance not found or not installed               | Check available instances with `p0 ls` or contact your administrator |
| `Could not identify principal for this access.`            | Email address could not be parsed                 | Verify your P0 account email address is correctly configured         |

### Related commands

* [p0 request](/p0-cli/p0-commands-and-usage/p0-request.md) - Request access without generating credentials
* [p0 aws role assume](/p0-cli/p0-commands-and-usage/p0-aws-role-assume.md) - Assume an AWS IAM role through Okta SAML
* [p0 aws permission-set assume](/p0-cli/p0-commands-and-usage/p0-aws-permission-set-assume.md) - Assume an AWS permission set through Identity Center
* [p0 login](/p0-cli/p0-commands-and-usage/p0-login.md) - Authenticate with P0
* [p0 ls](/p0-cli/p0-commands-and-usage/p0-ls.md) - List available resources

### Related documentation

* [PostgreSQL integration](https://github.com/p0-security/p0-docs/blob/main/integrations/resource-integrations/postgresql/README.md) - Configure P0 for PostgreSQL
* [MySQL integration](/integrations/resource-integrations/mysql.md) - Configure P0 for MySQL
* [Installing an RDS database](https://github.com/p0-security/p0-docs/blob/main/integrations/resource-integrations/postgresql/installing-an-rds-database.md) - Set up RDS with P0
* [Requesting PostgreSQL access](https://github.com/p0-security/p0-docs/blob/main/integrations/resource-integrations/postgresql/requesting-access.md) - All methods for requesting database access