The AWS Identity and Access Management (IAM) authentication method can be used to securely connect to the PostgreSQL database deployed on AWS. Instead of username and password credentials, users authenticate using their AWS Access Key and Secret Key, enhancing security and simplifying credential management.

Prerequisites
  • Enable IAM Authentication on the RDS instance via the AWS Management Console or CLI.
  • Create an IAM user and attach an appropriate IAM policy that grants access to the RDS instance.
  • Create the database user that IAM will map to, ensuring it matches the IAM user name.
  • Grant the necessary privileges to the database user that corresponds to the IAM role.
  • Verify that the instance’s parameter group has IAM database authentication enabled.
  • Configure IAM policies and roles to authorize the identity that will connect to the RDS instance.
Note: When using the AWSIAM authentication method, the encryptionMethod is automatically set to 'SSL', regardless of the value provided. This is because the driver requires an SSL connection to authenticate with AWS IAM.
To configure the driver to use AWS IAM authentication:
  • Specify values for minimum required properties for establishing a connection.
    • Set the ServerName property to specify either the IP address in IPv4 or IPv6 format, or the server name for your server.
    • Set the PortNumber property to specify the TCP port of the primary database server that is listening for connections to the database.
  • Set the AuthenticationMethod property to AWSIAM.
  • Set the AccessKey property to specify your access key ID for your IAM user or AWS account root user.
  • Set the Region property to specify name of the region that hosts your AWS server .For example, us-east-1 or us-east-2.

    For a list of regions, refer to the AWS documentation.

  • Set the SecretKey property to specify your secret access key for an IAM user or AWS account root user.
  • Set the TrustStore property to specify the directory of the truststore file to be used when SSL is enabled.
  • Set the TrustStorePassword property to specify the password that is used to access the truststore file.
  • Optionally, specify values for any additional properties you want to configure.

The following example shows the connection information required to establish a connection with AWS IAM authentication enabled.

For a connection URL:

Connection conn = DriverManager.getConnection
("jdbc:datadirect:postgresql://server1:5432;AuthenticationMethod=AWSIAM;
  AccessKey=ABCDEFGHIJKL1EXAMPLE;Region=us-east-2;
  SecretKey=aBcdeFGhiJKLM/N1OPQRS/tUvWxyzAEXAMPLEKEY");