p0 aws rds

Generate RDS database authentication tokens for PostgreSQL and MySQL through P0 just-in-time access.

Overview

Request just-in-time access to an Amazon RDS database and generate an IAM authentication token in a single command.

• Request access to a PostgreSQL or MySQL role through P0, or scope PostgreSQL access to a specific SQL script.

• Wait for approval and provisioning automatically.

• Authenticate to AWS and generate an RDS IAM authentication token.

• Output connection instructions for psql (PostgreSQL) or mysql (MySQL).

Prerequisites

• Logged-in user: Run p0 login <org> first.

• AWS CLI installed: The command uses aws rds generate-db-auth-token under the hood.

• PostgreSQL or MySQL integration installed: Your P0 administrator must have installed the PostgreSQL or MySQL integration with an RDS database.

• IAM authentication enabled: The target RDS instance must have IAM database authentication enabled.

• Network access: Your environment must have network access to the RDS instance (for example, through AWS CloudShell or a VPN).

Syntax

p0 aws [options] rds generate-db-auth-token --arch <arch> (--role <role> | --sql <script>) [--instance <id>] [--database <name>] [--reason <text>]

Arguments

This command has no positional arguments. All parameters are specified as options.

Options

Option	Type	Required	Description
--arch <type>	string	Yes	Database architecture: postgres or mysql. Use mysql for MariaDB.
--role <name>	string	Conditional	Database role to request access to. Specify either --role or --sql, not both.
--sql <script>	string	Conditional	SQL script to run. P0 requests only the privileges the script requires. Specify either --role or --sql, not both.
--instance <id>	string	No	P0 instance identifier. Required if multiple instances are configured.
--database <name>	string	No	Database name to connect to. Defaults to the instance's configured default database.
--reason <text>	string	No	Justification for audit and approver context. Required if your access policy asks for one.
--debug	boolean	No	Print debug information

You can set the P0_AWS_REASON environment variable instead of passing --reason on every command, which is useful in a CI job that requests access on a schedule.

--account is accepted by p0 aws but has no effect on this command. The AWS account comes from the grant P0 issues, so you don't select it yourself.

Output

When run in an interactive terminal, the command prints connection instructions including the generated authentication token. The instructions vary based on the --arch value:

PostgreSQL output:

export PGPASSWORD="<generated-token>"

psql "host=${RDS_HOST} port=5432 sslmode=verify-full sslrootcert=${RDS_SSL_CA} dbname=<database> user=p0_<your_username>"

MySQL output:

export MYSQL_PWD="<generated-token>"

mysql -h ${RDS_HOST} --ssl-ca=${RDS_SSL_CA} --ssl-verify-server-cert -P 3306 -u p0_<your_username> <database>

When piped or used in a non-interactive context, the command outputs only the raw authentication token.

P0 adds the p0_ prefix to the username to create a dedicated database user for your identity.

Examples

Generate a PostgreSQL authentication token

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role analyst \
  --account 123456789012

Requests the analyst role, waits for approval, and outputs psql connection instructions with the generated token.

Connect to a specific database and instance

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role readwrite \
  --instance my-prod-db \
  --database app_production

Supply a reason for the access request

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role analyst \
  --instance my-prod-db \
  --reason "investigating a support ticket"

Approvers see the reason when they review the request, and it is recorded in the audit log. If your organization's access policy requires a reason, a request without one is rejected.

Generate a MySQL authentication token

p0 aws rds generate-db-auth-token \
  --arch mysql \
  --role developer \
  --account 123456789012

Connect from AWS CloudShell

AWS CloudShell includes the RDS SSL certificate authority at /certs/global-bundle.pem and has network access to RDS instances in the same account:

export RDS_SSL_CA='/certs/global-bundle.pem'
export RDS_HOST='my-instance.abcdef.us-east-1.rds.amazonaws.com'

p0 aws rds generate-db-auth-token \
  --arch postgres \
  --role analyst \
  --account 123456789012

Follow the output instructions to set PGPASSWORD and connect with psql.

If you are not using CloudShell, download the RDS SSL certificate authority from the AWS documentation and set RDS_SSL_CA to the local path.

How it works

1. P0 authentication: Validates your P0 session (prompts for login if expired).

2. Access request: Creates a P0 access request for the specified database role and waits for approval.

3. AWS authentication: Obtains temporary AWS credentials through Okta SAML federation or AWS Identity Center, depending on your account configuration.

4. Token generation: Calls aws rds generate-db-auth-token with the temporary credentials to produce an IAM authentication token.

5. Connection instructions: Outputs the token and database-specific connection instructions.

RDS IAM authentication tokens are valid for 15 minutes. Generate a new token if your connection attempt fails after that window.

Error messages

Error	Cause	Solution
Did not receive access ID from server	Access request failed or was denied	Check your notification channel for request status
P0 granted access, but <instance> is not a RDS instance.	The instance is not configured as an RDS database	Verify the instance identifier with your P0 administrator
No instance with ID <id>	Instance not found or not installed	Check available instances with p0 ls or contact your administrator
Could not identify principal for this access.	Email address could not be parsed	Verify your P0 account email address is correctly configured

Related commands

• p0 request - Request access without generating credentials

• p0 aws role assume - Assume an AWS IAM role through Okta SAML

• p0 aws permission-set assume - Assume an AWS permission set through Identity Center

• p0 login - Authenticate with P0

• p0 ls - List available resources

Related documentation

• PostgreSQL integration - Configure P0 for PostgreSQL

• MySQL integration - Configure P0 for MySQL

• Installing an RDS database - Set up RDS with P0

• Requesting PostgreSQL access - All methods for requesting database access