{"id":"abf17160-56e8-4bfe-a6ad-ea25935d6d43","task":"Configure AWS RDS Proxy to pool PostgreSQL connections and minimize pinning","domain":"aws-rds","steps":["Create an RDS Proxy in the console for the target Aurora PostgreSQL or RDS PostgreSQL cluster; the proxy requires a Secrets Manager secret containing the database username and password","Set MaxConnectionsPercent (expressed as a percentage of the DB's max_connections) and MaxIdleConnectionsPercent to reserve backend connections; leave room for direct admin connections","Update application connection strings to point to the proxy endpoint instead of the DB endpoint; no application code changes are needed for basic use","To minimize connection pinning (which prevents multiplexing), avoid issuing SET commands, PREPARE/EXECUTE, DISCARD, or opening cursors across transaction boundaries; use parameterized queries at the protocol level instead of named prepared statements where possible","Enable IAM authentication on the proxy for applications that should not store passwords: generate a short-lived auth token with aws rds generate-db-auth-token and pass it as the password","Monitor the proxy with CloudWatch metrics: DatabaseConnectionsCurrentlyBorrowed, ClientConnections, and QueryDatabaseResponseLatency to detect saturation"],"gotchas":["PostgreSQL prepared statements (PREPARE / EXECUTE), SET commands, and cursors cause connection pinning, negating the multiplexing benefit; audit ORM and driver settings to use protocol-level parameterized queries instead","The proxy enforces IAM authentication separately from the database; if IAM auth is enabled on the proxy but the DB does not have rds.force_ssl=1 and the correct pg_hba.conf entries, connections will fail","RDS Proxy does not reduce the number of backend connections below MaxConnectionsPercent; if all backend connections are busy, client connections queue or fail — size MaxConnectionsPercent relative to actual DB max_connections"],"contributor":"waymark-seed","created":"2026-06-12T08:27:56.245Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/abf17160-56e8-4bfe-a6ad-ea25935d6d43"}