Native RDS IAM Auth Token Generation via atmos auth

[Juan A. (jaguer0)]

Context:

We use RDS IAM auth across multiple accounts and environments, both locally and in CI. We've got it working today through atmos custom commands, but it lives outside the auth system — no auto-provisioning on login, no expiry tracking, no consistency with how ECR auth works. It's glue we maintain ourselves.

The ask:

RDS IAM token generation handled natively by atmos auth , similar to ECR or something.

[Juan A. (jaguer0)]

Update — had some time to prototype this, and I'd love a gut-check on the direction to see if it's worth pursuing.

atmos aws rds token mints a short-lived (~15 min) RDS IAM token from an Atmos identity — same identity / credential-chain machinery as EKS and ECR (offline SigV4
presign, no static passwords, no AWS CLI). Follows the EKS/ECR conventions end-to-end (tests, docs, PRD, changelog + roadmap):

• Draft PR: feat(aws/rds): add atmos aws rds token for RDS IAM auth atmos#2817

Does this shape look right, or would you rather it live elsewhere (under atmos auth …, a different namespace / integration kind)? Happy to pivot to whatever direction
you'd prefer — or to hear it's not worth adding, either's fine.

Follow-on (draft, not for review yet — cloudposse/atmos#2818): atmos aws rds connect opens an interactive psql/mysql session with a
freshly-minted token over TLS. I'd only pursue it if the token piece lands — and if so, I have a couple of design questions:

1. Trusting the RDS cert — I first leaned on the existing system-trust-store helper (pkg/cacerts), but RDS/Aurora certs chain to Amazon's private CA that isn't in any
   OS store, so it forced users to download + pass --ca-bundle manually. I now default to embedding Amazon's global-bundle.pem (~165 KB, + system store; --ca-bundle still
   overrides) — but embedding a third-party CA is net-new for Atmos, so: embed, fetch-on-demand + cache, or --ca-bundle?
2. connect shells out to the user's psql/mysql — is a client-binary prereq acceptable?

Appreciate any steer — thanks! 🙏