Repository navigation
Proposal: Add optional Native Amazon Aurora DSQL Support #217
Description
Summary
Hi, I’m a developer on the Amazon Aurora DSQL team. Aurora DSQL uses the PostgreSQL wire protocol with IAM authentication and TLS. psqlODBC users currently require external code or proxies to generate and manage IAM tokens, adding operational complexity.
Proposed Support
Add an optional Aurora DSQL connection mode that:
- Uses the AWS credential chain.
- Resolves the AWS Region from the DSQL endpoint.
- Generates the appropriate IAM token for each new connection.
- Supports standard and admin database roles.
- Handles full-length tokens securely without persisting them.
- Enforces TLS certificate and hostname validation.
- Applies DSQL-compatible connection and session behavior.
The implementation would be isolated so existing PostgreSQL behavior remains unchanged. It may require an optional AWS authentication dependency, and I’m open to guidance on the preferred integration approach.
If this proposal is acceptable, I can prepare and submit a PR for upstream review. Looking forward to your feedback. Thanks!
Reacted by Spencer Corwin
Activity
[-]Proposal: Add Native Amazon Aurora DSQL Support[/-][+]Proposal: Add optional Native Amazon Aurora DSQL Support[/+]davecramer commentedon Sep 29, 2026
Have you seen https://github.com/aws/aws-advanced-odbc-wrapper
praba2210 commentedon Sep 29, 2026
Thanks for the link, I'll check it out!
praba2210 commentedon Oct 13, 2026
Hi @davecramer , I looked at the wrapper. Its IAM plugin generates RDS IAM tokens, which Aurora DSQL
doesn't accept because DSQL tokens are signed for a different service (
dsql, withDbConnect/DbConnectAdmin). So today psqlODBC users have to generate the DSQL IAM token outsidethe driver and pass it as the password. Those tokens expire, so every new connection needs a fresh
one, and native support would let psqlODBC generate one per connection instead of relying on
external scripts or proxies.
Please let me know what do you think of DSQL upstream? Thanks.
davecramer commentedon Oct 13, 2026
@praba2210 how much trouble would it be to change the wrapper version to use DSQL tokens ?
praba2210 commentedon Oct 13, 2026
@davecramer Not much trouble. The wrapper's auth flow is generic, only the token generation is RDS specific, so adding DSQL specific feature is straightforward.
For long term, I'd still like to have native DSQL IAM auth in psqlODBC as an optional, so user don't need second driver?