Connectivity

VPC requirements

• RDS for Db2 lives in a VPC (not publicly accessible by default).
• Security group inbound: TCP 50000 (plain), 50443 (SSL, controlled by ssl_svcename).
• CloudShell MUST use a VPC environment (Actions → Create VPC Environment) in the same subnet/AZ as the RDS instance.
• EC2 clients: same VPC or peered VPC, with routing and SG rules.
• Private subnet: use airgap flow + VPC endpoints for S3, SSM, Secrets Manager.

Install — online mode

Works from EC2 or CloudShell with internet.

Step 1 — Download the installer scripts:

Writes db2-driver.sh (RT client installer) and db2client-airgap.sh (airgap bundler) to the current directory.

Step 2 — Install the RT client (run as root or ec2-user):

DB2_VER defaults to 11.5. On completion the script prints the next command.

Step 3 — Configure DSN entries (as db2inst1):

Step 4 — Activate helper functions:

source ~/functions.sh is added to ~/.bashrc automatically during configure.

Install — airgap mode

Private subnet with no internet. Artifacts staged in S3.

Step 1 — On internet-connected machine, download:

Produces ./db2client-artifacts/{scripts,drivers,ssl}/.

Step 2 — On AWS-configured machine, upload to S3:

Creates db2client-artifacts-<account-id>-<region>, uploads all artifacts, verifies every file, prints target-machine commands.

Step 3 — On target (private subnet, AWS configured):

Step 4 — Configure DSNs (as db2inst1):

Reach EC2 via SSM: aws ssm start-session --target <ec2-instance-id> --region <region>.

What db2client-configure.sh creates

DSN entries in db2dsdriver.cfg:

Files written:

Connecting

Single quotes around $MASTER_USER_PASSWORD protect special characters (!, >, <, $).

Security considerations

• Passwords in shell history. db2 connect ... using '<password>' writes the password into shell history and the process list. Prefer db2_connect / db2_use, which read the password from ~/.db2env (env var, not a literal argument). If you must type a literal password, clear it from history afterward (history -d <n> or unset HISTFILE for the session).
• Prefer Secrets Manager. Provision with --manage-master-user-password so RDS stores and rotates the master password in Secrets Manager; db2_use fetches the current value automatically after each rotation.
• ~/.need_password is dev/test only. A plaintext password file is never acceptable for production. When used for local dev/test it must be chmod 600 and must never be committed to source control or shared.
• Use SSL DSNs (50443). Prefer the *S / *SK (SSL) DSNs over plain TCP (50000) so credentials and data are encrypted in transit. See connectivity-tls.md for certificate setup.
• Never log credentials. Do not log full connection strings, DSN parameters, or password values in application or diagnostic logs. Use structured logging and mask password fields before writing to CloudWatch Logs or any log sink.

Helper functions (source ~/functions.sh)

db2_test_connection decodes these:

For SSL/TLS, GSKit, and certificate setup, see connectivity-tls.md.

Manual password file (~/.need_password)

Warning — dev/test only. A plaintext password file is NEVER acceptable for production. For any production or shared instance use --manage-master-user-password so RDS stores and rotates the master password in Secrets Manager; db2_use then fetches it automatically. The ~/.need_password fallback exists solely for local dev/test instances that are not integrated with Secrets Manager, and must be chmod 600 and never committed to source control or shared.

If not using Secrets Manager:

Troubleshooting

Full diagnostics: db2_test_connection / db2_test_connection RDSAS.

Find Db2 version:

For Python/Java drivers, Kerberos/AD, MacBook laptop, and multi-instance workflow, see connection-drivers.md.