End-to-end IAM for RDS postgres

Hello.

I tried it with my AWS account and was able to access it successfully.
When creating the RDS Proxy, I enabled IAM authentication as follows:

The following IAM policy is set for the RDS Proxy IAM role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds-db:connect"
            ],
            "Resource": [
                "arn:aws:rds-db:ap-northeast-1:123456789012:dbuser:db-123456789012/postgres"
            ]
        }
    ]
}

The database user has IAM authentication enabled with the following command.

CREATE USER dbuser;
GRANT rds_iam TO dbuser;
GRANT CONNECT ON DATABASE postgres TO dbuser;

Finally, I connected to the VPC from CloudShell using the following command.

export PGPASSWORD=$(aws rds generate-db-auth-token --hostname hogerdsproxy.proxy-1234567890.ap-northeast-1.rds.amazonaws.com --port 5432 --username dbuser)
psql "host=hogerdsproxy.proxy-1234567890.ap-northeast-1.rds.amazonaws.com port=5432 dbname=postgres user=dbuser password=$PGPASSWORD sslmode=require"

The security group is configured as follows:

RDS Proxy SG (Inbound)

RDS SG (Inbound)

By the way, I confirmed that I can connect even if I create a token etc. using the script you created.
The following IAM policy is set for "arn:aws:iam::1234:role/dbuser".

{
    "Statement": [
        {
            "Action": [
                "rds-db:connect"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:rds-db:ap-northeast-1:123456789012:dbuser:prx-12345678/dbuser"
            ]
        }
    ],
    "Version": "2012-10-17"
}

1. It seems like the web portal requires you to add in secrets no matter what, does this affect the usage of end-to-end IAM? If I remove Secrets Manager Secrets in the proxy configuration page the IAM authentication field falls back to "Not Allowed" which would seem to be a step backwards.

2. I am aware of the broad policies, I am trying to get this working and am trying a lot of things to get a connection to work. As mentioned before I did have them set to more specific values and will work on tightening them up once I find out the root cause here.

3. I added the connect privilege though I think it was allowed before postgres=> GRANT CONNECT ON DATABASE postgres TO dbuser; GRANT

4. I have tried now to connect now with verify-full and using multiple different Root CA PEMs found at https://www.amazontrust.com/repository/ and none have worked. I have also tried the globa-bundle.pem located at https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html

5. Token generation is using the proxy and one of the first things in the token is the url of the proxy endpoint. I went ahead and changed the iam resources as requested to the prx arn with my correct account/proxy id/user name

For the proxy what exactly should I have for each field under Authentication? I currently have Default authentication scheme: IAM Authentication Identity and access management (IAM) role: my proxy's role which is separate from my dbuser Secrets Manager Secrets: test_user_db_password (this is just some BS password that I used to get past the web UIs gating) Client authentication type: SCRAM SHA 256 IAM authentication: Required

Connectivity has "Require Transport Layer Security" enabled

For the security groups, it should be enough to have Proxy SG

• Outbound to the RDS SG on 5432 RDS SG
• Inbound from the Proxy SG on 5432

Correct?

Based on the information provided, you're trying to set up end-to-end IAM authentication with RDS Proxy for PostgreSQL. This is a feature that was announced in September 2025 and is now available for MySQL and PostgreSQL database engines.

Here are some issues with your current setup and how to fix them:

1. IAM Authentication Configuration: End-to-end IAM authentication eliminates the need for Secrets Manager credentials. However, your proxy IAM role still includes permissions to read secrets from Secrets Manager, which suggests you might be mixing the standard IAM authentication approach with end-to-end IAM authentication.

2. IAM Policy Resource Scope: Your role's permission policy uses a wildcard (arn:aws:rds-db:us-west-2:1234:dbuser:*/*) which is very broad. For better security, you should specify the exact proxy and database user ARN.

3. Database User Setup: While you've created the database user and added it to the rds_iam group, ensure that this user has been granted the CONNECT privilege on the database you're trying to connect to.

4. SSL/TLS Configuration: The error message indicates an SSL connection issue. When using IAM authentication with RDS Proxy, you must use TLS/SSL. Make sure you're using the correct SSL certificate (you mentioned rds-ca-rsa2048-g1) and that your sslmode is set to verify-full rather than just require.

5. Token Generation: Ensure you're generating the token correctly. The token should be generated for the proxy endpoint, not the direct database endpoint.

Here's what you should do:

1. Update your IAM policy to specifically target the proxy and user:

"Resource": "arn:aws:rds-db:us-west-2:1234:dbuser:prx-abcd/dbuser"

2. If you're using end-to-end IAM authentication, you don't need the Secrets Manager permissions in your proxy role.

3. Make sure your PostgreSQL user has the proper permissions:

GRANT CONNECT ON DATABASE postgres TO dbuser;

4. Update your connection string to use verify-full for SSL mode and specify the correct certificate:

psql "host={ENDPOINT} port={PORT} dbname=postgres user={USR} sslmode=verify-full sslrootcert=/path/to/rds-ca-rsa2048-g1.pem"

5. Ensure your security groups allow traffic between your client and the proxy.

The error message about SSL connection being closed unexpectedly often indicates either a certificate issue or a security group configuration problem. Double-check both of these aspects.

Regarding the aws rds modify-db-proxy help text you mentioned, that specific limitation about ENABLED being valid only for SQL Server applies to a different context and doesn't mean end-to-end IAM authentication isn't available for PostgreSQL.
Sources
What's New at AWS - Cloud Innovation & News
Connecting to a database through RDS Proxy - Amazon Relational Database Service
Setting up AWS IAM Authentication with Amazon RDS Proxy for Aurora PostgreSQL | AWS re:Post
Connecting to a database through RDS Proxy - Amazon Aurora