Setting the file. One moment.
Subchapter 72.6
references/connection-drivers.mdMarkdown4 KBView on GitHub
Connecting from Python, Java, and laptop clients; Kerberos/Active Directory auth; managing multiple RDS for Db2 instances from the same shell.
import ibm_db
conn_str = (
"DATABASE=RDSADMIN;"
"HOSTNAME=<rds-endpoint>;"
"PORT=50443;"
"PROTOCOL=TCPIP;"
"UID=<master-user>;"
"PWD=<password>;"
"Security=SSL;"
"SSLServerCertificate=/path/to/<region>-bundle.pem;"
)
conn = ibm_db.connect(conn_str, "", "")Download the cert bundle first:
curl -sL https://truststore.pki.rds.amazonaws.com/<region>/<region>-bundle.pem -o ~/<region>-bundle.pemWith the IBM Db2 JDBC driver (db2jcc4.jar), point sslTrustStoreLocation at the PEM file — no keystore or keytool needed:
Properties props = new Properties();
props.setProperty("user", "<master-user>");
props.setProperty("password", "<password>");
props.setProperty("sslConnection", "true");
props.setProperty("sslTrustStoreLocation", "/path/to/<region>-bundle.pem");
Connection conn = DriverManager.getConnection(
"jdbc:db2://<rds-endpoint>:50443/RDSADMIN:sslConnection=true;",
props
);See scripts/Db2SslTest.java for a runnable end-to-end example.
Install IBM Db2 Data Server Driver Package (dsdriver) from IBM Fix Central or Passport Advantage:
source ~/dsdriver/bin/db2profile
db2 catalog tcpip node RDSNODE remote <rds-endpoint> server 50000
db2 catalog database <dbname> as RDSDB at node RDSNODE
db2 terminate
db2 connect to RDSDB user <master-user> using '<password>'For SSL, download the bundle (same URL as above) and catalog with SSL parameters pointing to the PEM.
For self-managed Active Directory join and Kerberos authentication — AD permission delegation, the Secrets Manager secret keys, the --domain-fqdn/-ou/-auth-secret-arn/-dns-ips join flags, the AD port matrix, and the JDBC Kerberos connection (securityMechanism=11) with the bundled Db2KerberosConnection.java / db2-kerberos-test.sh test — see ad-kerberos.md.
db2client-configure.sh configures one instance at a time. Re-run for each:
# Configure instance 1
REGION=us-east-1 source db2client-configure.sh # select end-to-end-trust
# Configure instance 2
REGION=us-east-1 source db2client-configure.sh # select trp-test-by-ibm
# Switch between them in one session
db2_use end-to-end-trust
db2 "connect to RDSADMIN user admin using '$MASTER_USER_PASSWORD'"
db2 "select * from sysibm.sysdummy1"
db2 connect reset
db2_use trp-test-by-ibm
db2 "connect to RDSADMIN user admin using '$MASTER_USER_PASSWORD'"
db2 connect reset
db2_show_env # confirm which instance is activeHow db2_use actually works (important for understanding password rotation):
~/.db2instances (populated by db2client-configure.sh for each instance you registered).aws secretsmanager get-secret-value against the instance’s secret to fetch the current master password (automatically handles secret rotation).~/.need_password.~/.db2env with the active instance’s DSN, user, password.So after a password rotation in Secrets Manager, the only thing you need to do is re-run db2_use <instance-id> — the helper picks up the new password automatically. You do not need to re-run db2client-configure.sh.
| Path | Purpose |
|---|---|
~/functions.sh | Helper functions |
~/db2client-configure.sh | Re-run to refresh DSN setup |
~/CONN_HELP_README.txt | Last configure’s connect commands |
~/.db2env | Active instance credentials (chmod 600) |
~/.db2instances | Instance registry, no passwords (chmod 600) |
~/.need_password | Passwords when not using Secrets Manager — dev/test only, never production (chmod 600) |
~/<region>-bundle.pem | RDS SSL certificate bundle |
~/sqllib/cfg/db2dsdriver.cfg | Db2 DSN config |
~/sqllib/cfg/db2cli.ini | Db2 CLI config |