Setting the file. One moment.
Skill 62 · Amazon Aurora PostgreSQL
Subchapter 62.13
references/express-create-instructions.mdMarkdown8 KBView on GitHub
Express configuration is a single-API-call provisioning path for Aurora PostgreSQL. It creates an Aurora serverless cluster fronted by an AWS-managed connectivity layer (no customer VPC).
Use this sub-skill when the user asks about creating Aurora with express configuration, evaluating fit, or comparing express vs full. The create sub-skill routes here when express is the right default; route back to create for any workload needing a customer VPC, custom KMS, custom parameters, or Aurora MySQL.
Execute commands via the AWS MCP server when connected (sandboxed, audit-logged). Fall back to the AWS CLI or shell otherwise.
Express is the right default for Aurora PostgreSQL when ALL of these are true:
If any fail, route to full configuration. Load use-cases.md for canonical scenarios on either side of the boundary.
Required: cluster identifier, region. Optional: anything else the user supplies (most defaults cannot be overridden in express).
State the configuration explicitly for confirmation. MUST surface:
Wait for explicit confirmation (“yes”, “proceed”, “confirmed”).
Express is one API call. Use the AWS CLI as the primary path (the --with-express-configuration flag requires AWS CLI v2.33+); fall back to the boto3 SDK only if the environment has an older CLI.
AWS CLI (primary — requires v2.33+):
aws rds create-db-cluster \
--db-cluster-identifier <cluster-id> \
--engine aurora-postgresql \
--with-express-configuration \
--region <region> \
--tags Key=created_by,Value=aurora-skill Key=generation_model,Value=<your-model-id>boto3 (alternative — for environments with AWS CLI older than v2.33):
import boto3
client = boto3.client("rds", region_name="<region>")
client.create_db_cluster(
DBClusterIdentifier="<cluster-id>",
Engine="aurora-postgresql",
WithExpressConfiguration=True,
Tags=[
{"Key": "created_by", "Value": "aurora-skill"},
{"Key": "generation_model", "Value": "<your-model-id>"},
],
)If the CLI returns Unknown options: --with-express-configuration, the installed version is too old — update the CLI (aws --version should show 2.33+) or use the boto3 fallback above.
Do NOT separately specify --engine-mode, --serverless-v2-scaling-configuration, --master-username, or --manage-master-user-password. The express flag sets all of these automatically.
After the cluster is available, enable PostgreSQL log export to CloudWatch for operational visibility:
aws rds modify-db-cluster --db-cluster-identifier <cluster-id> --region <region> \
--cloudwatch-logs-export-configuration '{"EnableLogTypes":["postgresql"]}'These logs can contain sensitive data (query text, table/column names), so ensure the CloudWatch log group is encrypted (KMS) and access-restricted, and treat the logs as sensitive when sharing.
Express clusters use IAM-only authentication via the Internet Access Gateway. There is no master password. When the user asks how to connect or run SQL, walk them through the IAM auth token flow — do NOT offer to run SQL yourself, suggest the Data API as a workaround, or try to set a master password. The skill creates the cluster and provides the connection workflow; it does NOT execute SQL.
Full workflow (wait-for-available, IAM token generation, Data API caveats, adding users): see connect-iam.md.
When explaining what express IS or proposing it for a new cluster, you MUST include ALL of:
https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_GettingStartedAurora.AuroraPostgreSQL.ExpressConfig.html)aws rds generate-db-auth-token — required even on a create/propose turn. “Connect using a short-lived IAM auth token” alone is INCOMPLETE; it must be paired with the aws rds generate-db-auth-token command name.--with-express-configuration flag, not by composing individual --engine-mode / --serverless-v2-scaling-configuration flags--manage-master-user-password, or recommend the Data API as a workaround for connection issues — express is IAM-only (see section 6). Data API is out of scope for the connect flow; only mention it if the user explicitly asks.When any of these appear, route to the create sub-skill (full configuration):
Load comparison.md for a side-by-side feature matrix.