Stop Hardcoding Your Database Credentials in Lambda — Use IAM Authentication with RDS Proxy Instead

Your Lambda function connects to RDS, queries the database and returns results. In your environment variables, you have a username and password stored in plain text. This approach is not ideal and can be compromised by misconfigurations, accidental log exposures, or leaked deployment artifacts. AWS offers a solution to eliminate database passwords entirely from your Lambda code, improving security and eliminating rotation headaches and secrets leaks.

This article explains how to use IAM Authentication with RDS Proxy instead of hardcoding credentials in Lambda.

IAM Authentication with RDS Proxy works by generating a temporary IAM token with a 15-minute validity, which Lambda uses as the database password for the connection. AWS validates the token internally, ensuring that no credentials leave your environment. The process involves creating an IAM role with the rds-db:connect permission, creating a MySQL user that delegates authentication to AWS IAM, configuring RDS Proxy to require IAM Authentication, and attaching the IAM policy to the Lambda role. The Lambda function must be in the same VPC and subnets as the RDS Proxy for the setup to work.

To enable IAM Authentication on RDS, navigate to RDS → Databases, select your RDS MySQL instance, and modify the settings. Under Database authentication, choose Password and IAM database authentication. To enable IAM Authentication on RDS Proxy, select your Proxy, modify the settings, and under IAM authentication, choose Required.

The next step is to create a MySQL user without a password by connecting to your RDS instance, executing a CREATE USER command, and granting SELECT, INSERT, and UPDATE permissions on the desired database. Finally, attach the necessary IAM policy to your Lambda role and configure the Lambda function to run in the same VPC and subnets as the RDS Proxy.