Feature Request: Automatically get password for AWS RDS IAM based authentication

[kinghuang]

I have an RDS Aurora PostgreSQL cluster with IAM-based authentication enabled. To connect, I need to call the GenerateRDSAuthToken API to generate a temporary token to use as the password. Here's an example CLI command.

aws rds generate-db-auth-token --hostname some-postgres-host --port 5432 --region us-west-2 --username some-username

The tokens only last 15 minutes. It would be really helpful if there was a way to configure a postgres secret to get the password through the above API call or by invoke a CLI command.

[seanknapp]

We're also encountering this as a need as well. I'm happy to implement a solution here, but would love some guidance as I'm new to the codebase and there are a couple of approaches to take.

As I understand it, each connection gets a pool of up to 64 (configurable) that are lazily initialized. This means that any connection not made by the 15 minute mark has no ability to connect going forward. Looking through the code, I also believe values from secrets are passed & stored by the constructor, so updates to the secret itself do not have any effect.

Our specific implementation is using DuckLake with RDS as the metadata store.

Possible solutions:

1. Modify constructor to take just a secret name, and when making a new connection in the pool, fetch the latest values. (this does run a risk of hostname and other values being changed, but could protect against that pretty easily)
2. Modify constructor to receive a callback to get updated connection string or config (or just password value), along with an interval to perform said callback
3. Modify library to take an AWS ARN and make the API call directly to get updated passwords (this would require the AWS auth chain be properly configured through environment variables and/or config files)

Any quick guidance here would be much appreciated; happy to turn around a PR pretty quickly from there.

[kinghuang]

Option 3 would be preferable, in my opinion. My use case is also for DuckLake with RDS as the metadata store!