Express Create Connect IAM

Data API cannot be enabled at create time on express clusters. The create-time --enable-http-endpoint flag is incompatible with --with-express-configuration (express forces IAM-only authentication at creation). However, Data API CAN be enabled AFTER creation via ModifyDBCluster (aws rds modify-db-cluster --enable-http-endpoint). Note it does not support master username/password authentication; you must create separate database user credentials to use Data API. The recommended/primary connection method for express is a direct connection with a short-lived IAM auth token.

1. Wait for the cluster to be available. The Endpoint field is populated only when status is available:

   bashCopy

   aws rds describe-db-clusters --db-cluster-identifier <cluster-id> --region <region> \
     --query "DBClusters[0].{Status:Status,Endpoint:Endpoint}"

   Poll until Status is "available" and Endpoint is non-null.

2. Connect with an IAM auth token (recommended/primary method). The master user is postgres (configured for IAM auth automatically):

   bashCopy

   RDSHOST="<endpoint from describe-db-clusters>"
   TOKEN=$(aws rds generate-db-auth-token --hostname $RDSHOST --port 5432 --region <region> --username postgres)
   PGPASSWORD=$TOKEN psql "host=$RDSHOST port=5432 dbname=postgres user=postgres sslmode=require" -c "SELECT 1;"

   Or in Python:

   pythonCopy

   import boto3, psycopg2
   rds = boto3.client("rds", region_name="<region>")
   token = rds.generate_db_auth_token(DBHostname=endpoint, Port=5432, DBUsername="postgres")
   conn = psycopg2.connect(host=endpoint, port=5432, database

3. Tokens expire in 15 minutes — the user generates a fresh token before each session or query batch. generate-db-auth-token produces a short-lived IAM token; it is not a stored credential but the secure, approved connection method. The call is the user’s responsibility, not the skill’s.

4. Adding additional database users: the user creates them in the database directly and configures each for IAM auth. Source: IAM database authentication for Aurora (opens in a new tab).

The skill creates the cluster and provides the connection workflow above. The skill does NOT execute SQL against the cluster — the user runs queries themselves via psql, the RDS Data API (with separately created credentials), or their application.