Permanent tokens for Aurora Dsql

Amazon Aurora DSQL is designed to use token-based authentication through AWS Identity and Access Management (IAM) rather than traditional password-based authentication. This is a deliberate security design choice - Aurora DSQL blocks standard user password-based authentication while maintaining PostgreSQL wire protocol compatibility.

Regarding token lifespans, Aurora DSQL authentication tokens do have expiration limits, but they can be configured for longer durations than you might be using currently. When generated through the AWS console, tokens expire in one hour by default. When using the AWS CLI or SDKs, the default expiration is 15 minutes. However, you can set a maximum duration of up to 604,800 seconds (one week) for these tokens.

It's important to note that once a connection is established with a valid token, that connection remains valid even after the token expires. You only need to generate a new token when establishing a new connection.

For integration with third-party tools that require longer-lived connections, you could implement a solution that automatically refreshes tokens before they expire, or establish connections that remain open for extended periods.

Currently, there is no option to authenticate with permanent user/password combinations in Aurora DSQL as this would go against its security design principles.
Sources
Generating an authentication token in Amazon Aurora DSQL - Amazon Aurora DSQL
Introducing Amazon Aurora DSQL | AWS Database Blog