Search articles, utilities, learning content, community Q&A, members, tags, and topics.
Start with
Search areas
Choose an area such as Articles, Utilities, Community Q&A, Learning, Members, or Tags & topics.
AWSAmazon RDSAWSBastion HostRDS ProxySSM
Article & Tutorial
Amazon RDS Proxy Explained: Setup, Connection Examples, and RDS Proxy vs SSM vs Bastion Host
Learn how Amazon RDS Proxy works, when to use it, how applications and administrators connect, and how it differs from AWS Systems Manager Session Manager and bastion hosts.
Amazon RDS Proxy Explained: Setup, Connection Examples, and RDS Proxy vs SSM vs Bastion Host technical illustrationContents
Modern applications can open hundreds or thousands of database connections in a very short time. This is common with AWS Lambda, autoscaling containers, microservices, and traffic spikes. If every application instance connects directly to Amazon RDS or Amazon Aurora, the database can spend too much memory and CPU managing connections instead of processing queries.
Amazon RDS Proxy provides a managed connection-pooling layer between your application and the database. It reuses database connections, improves resilience during database failover, and helps applications handle sudden connection growth more safely.
Important: RDS Proxy, AWS Systems Manager Session Manager, and a bastion host solve different problems. RDS Proxy is for application-to-database connection management. Session Manager and bastion hosts are administrative access methods.
What Is Amazon RDS Proxy?
Amazon RDS Proxy is a fully managed, highly available database proxy for supported Amazon RDS and Aurora database engines. Applications connect to the proxy endpoint instead of connecting directly to the database endpoint.
The proxy maintains a pool of established database connections. When an application requests a connection, the proxy can reuse an existing backend connection rather than forcing the database to create a new one each time.
Basic Architecture
bash
Application / Lambda / ECS / EC2 | | Database connection v Amazon RDS Proxy | | Pooled database connections v Amazon RDS / Aurora
Why Use RDS Proxy?
Connection pooling: Reduces the number of simultaneous connections reaching the database.
Better handling of traffic spikes: Useful when Lambda functions or containers scale rapidly.
Improved failover behavior: The proxy can help applications recover more quickly when the underlying database fails over.
Centralized credential handling: Database credentials can be stored in AWS Secrets Manager.
IAM database authentication: Applications can use IAM-based authentication where supported and correctly configured.
Less application-side connection management: The proxy reduces pressure on application connection pools, although applications should still use sensible pooling and timeout settings.
When Should You Use RDS Proxy?
RDS Proxy is especially useful in the following situations:
AWS Lambda functions connect to an RDS or Aurora database.
ECS or EKS workloads scale horizontally and create many short-lived connections.
A web application experiences sudden traffic bursts.
The database is approaching its maximum connection limit.
You need improved database failover handling without building a custom proxy layer.
Multiple application services connect to the same database and need controlled connection usage.
When RDS Proxy May Not Be Necessary
The application has a small and stable number of long-lived connections.
The application already uses an effective connection pool and the database has sufficient capacity.
The workload depends heavily on session-specific behavior that causes connections to remain pinned to one backend database connection.
The additional RDS Proxy cost is not justified for a low-traffic environment.
Prerequisites
An existing supported Amazon RDS or Aurora database.
A VPC with suitable subnets in multiple Availability Zones.
Security groups allowing the application to reach the proxy and the proxy to reach the database.
A database user and password stored in AWS Secrets Manager, unless your selected authentication design uses IAM end to end.
An IAM role that allows RDS Proxy to retrieve the required secret.
TLS enabled for production connections wherever possible.
How to Create an RDS Proxy in the AWS Console
Open the Amazon RDS console .
Choose Proxies and select Create proxy .
Enter a clear proxy name, such as orders-prod-proxy .
Select the database engine family that matches your RDS or Aurora database.
Configure the connection pool settings, including the idle client connection timeout.
Select the target database or Aurora cluster.
Choose the Secrets Manager secret containing the database credentials.
Select or create the IAM role that allows the proxy to access the secret.
Select the VPC, private subnets, and proxy security group.
Configure TLS requirements and authentication options.
Create the proxy and wait until its status becomes Available .
Security Group Design
A clean production design normally uses separate security groups:
bash
Application security group | TCP 5432 or 3306 v RDS Proxy security group | TCP 5432 or 3306 v Database security group
The proxy security group should allow inbound database traffic only from the application security group and approved administrative paths.
The database security group should allow inbound database traffic from the proxy security group.
Avoid allowing database ports from 0.0.0.0/0 .
RDS Proxy is designed for VPC connectivity; do not treat it as a public database gateway.
Connect to RDS Proxy from PostgreSQL
After the proxy becomes available, copy its endpoint from the RDS console.
import os import psycopg connection = psycopg.connect( host=os.environ["DB_PROXY_ENDPOINT"], port=5432, dbname=os.environ["DB_NAME"], user=os.environ["DB_USER"], password=os.environ["DB_PASSWORD"], sslmode="require", connect_timeout=10, ) with connection.cursor() as cursor: cursor.execute("SELECT current_timestamp") print(cursor.fetchone()) connection.close()
Node.js Example Using PostgreSQL
bash
import pg from "pg"; const { Pool } = pg; const pool = new Pool({ host: process.env.DB_PROXY_ENDPOINT, port: 5432, database: process.env.DB_NAME, user: process.env.DB_USER, password: process.env.DB_PASSWORD, ssl: { rejectUnauthorized: true }, max: 10, connectionTimeoutMillis: 10000, idleTimeoutMillis: 30000, }); const result = await pool.query("SELECT current_timestamp"); console.log(result.rows[0]); await pool.end();
Connecting from AWS Lambda
Place the Lambda function in subnets that can route to the proxy. Attach a security group that is permitted by the proxy security group. Store the proxy endpoint in an environment variable rather than hard-coding it.
Initialize reusable database clients outside the Lambda handler when the library and execution model support it. RDS Proxy protects the database from connection storms, but efficient client reuse still improves performance.
How to Connect from a Developer Laptop Using Session Manager
A private RDS Proxy endpoint is not directly reachable from the internet. For temporary administrative access, you can use AWS Systems Manager Session Manager port forwarding through an EC2 managed instance that has network access to the proxy.
Requirements
An EC2 instance in the VPC with SSM Agent installed and running.
An IAM instance profile that allows Systems Manager managed-instance access.
Systems Manager connectivity through internet access or VPC endpoints.
The EC2 instance security group and proxy security group must permit the required traffic.
The Session Manager plugin and AWS CLI must be installed on the laptop.
mysql --host=127.0.0.1 --port=13306 --user=app_user --password
Can SSM Agent Be Installed on RDS?
No. You do not install SSM Agent on Amazon RDS, Aurora, or RDS Proxy. These are managed services and do not provide operating-system access.
SSM Agent runs on supported compute resources such as EC2 instances, on-premises servers, edge devices, and some virtual machines registered as managed nodes. In this architecture, the managed EC2 instance acts as the network hop for Session Manager port forwarding.
Connecting Through a Bastion Host
A bastion host is an EC2 instance used as a controlled entry point into private subnets. Administrators first connect to the bastion and then access internal resources.
Feature RDS Proxy SSM Session Manager Bastion Host Primary purpose Manage application database connections Secure administrative access and tunneling Jump server for administrative network access Used by Applications, Lambda, ECS, EKS, EC2 Administrators and automation Administrators and support teams Connection pooling Yes No No Requires an EC2 instance No dedicated proxy instance Requires a managed node for remote-host forwarding Yes Inbound SSH port required No No Normally yes, unless combined with SSM Database failover assistance Yes No No OS patching required No Managed node still requires maintenance Yes Best use case Production application traffic Temporary, auditable admin access Legacy or specialized jump-host workflows
No comments yet. Start the discussion.