Amazon RDS (MySQL / MariaDb)

Amazon Relational Database Service (or Amazon RDS) is a cloud-based distributed relational database service designed to simplify the setup, operation, and scaling of a relational database for use in applications. It also helps with relational database management tasks, such as data migration, backup, recovery and patching.

The Amazon RDS integration has 2 options to connect:

• A direct connection to the RDS database
• Direct connection via IAM-based authentication and RDS auto-discovery

Note: The AWS Lambda connection option is now deprecated in favor of Relyance DirectConnect, which provides a more secure and reliable connection method. Please reach out to your Relyance support team to learn more about enabling DirectConnect for your environment.

The AWS Lambda method is still offered in the connection drop-down for existing setups. It takes Account ID, Role Name, External ID, Region, Lambda Function Name, Crawler Configuration and the Use IAM-based Authentication checkbox (Database User and Secret Name are optional). Use IAM-based Auth or Direct Connection for anything new.

Prerequisites Database User Setup

Before connecting via either method (Direct Connection or IAM-based Authentication), you must create a dedicated database user and grant appropriate permissions.

Step 1: Create the Relyance User

Create a user in every database you want Relyance to scan. The exact command depends on your authentication method.

MySQL / MariaDB

For Direct Connection (password-based):

CREATE USER 'relyance_user'@'%' IDENTIFIED BY 'your_password';

For IAM-based Authentication:

CREATE USER 'relyance_user' IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';

PostgreSQL

For Direct Connection (password-based):

CREATE USER relyance_user WITH PASSWORD 'your_password';

For IAM-based Authentication:

CREATE USER relyance_user; GRANT rds_iam TO relyance_user;

Step 2: Grant Permissions

Provide the necessary read and metadata privileges for Relyance to perform data discovery and inspection.

MySQL and MariaDB:

GRANT SELECT,SHOW VIEW,EXECUTE ON . TO 'relyance_user'@'%'; FLUSH PRIVILEGES;

PostgreSQL:

GRANT CONNECT ON DATABASE {{ DB_NAME }} TO relyance_user; GRANT USAGE ON SCHEMA {{ DB_SCHEMA }} TO relyance_user; GRANT SELECT ON ALL TABLES IN SCHEMA {{ DB_SCHEMA }} TO relyance_user;

If you’re running PostgreSQL 14 or later, you can replace individual GRANT statements with the built-in role pg_read_all_data:

GRANT pg_read_all_data TO relyance_user;

This provides read access across all schemas and tables within the database.

You (or your administrator) will need to run these statements for each PostgreSQL database and schema you want to analyze.

Direct Connection

Relyance supports two methods for connecting to your Amazon RDS database. Choose the option that best fits your security and networking setup.

Option 1: Secure Connection (Site-to-Site VPN via DirectConnect) Configuration in RDS

This is the recommended method for secure, private connectivity. Relyance DirectConnect establishes a site-to-site VPN between your environment and Relyance AI, eliminating the need for public database exposure.

To set this up, review the documentation to configure the site-to-site VPN here and reach out to our support team for next steps. Once your VPN is configured, proceed with adding your Amazon RDS integration in Relyance.

Option 2: Standard Direct Connection Configuration in RDS

If a VPN setup isn’t available, you can connect using a standard direct connection. This method requires making your RDS instance publicly accessible and allowing Relyance IP addresses through security groups.

This next section ensures you can share your RDS database with the Relyance AI application.

• Log in to your AWS management console.
• In the search bar search for RDS and click on RDS.
• Click on Databases in the left-hand navigation.
• Select the database you want to process and click the Modify button.
• Scroll down to the Connectivity section and set Public Access to Publicly accessible.
• Save the changes.
• On the database dashboard select your database.
• Scroll down to the Connectivity & Security section and click on the security groups link under VPC security groups.
• On the bottom half of the page click on Inbound rules tab.
• Click the Edit inbound rules button.
• Click Add rule, select:
  • The port of the SQL engine in the Type dropdown:
    • 3306 MySQL/MariaDB
    • 5432 Postgres
    • 1433 MSSQL
  • Source type: Custom
  • Source: add all the IP Addresses from the article Relyance AI IP Addresses for Allow Lists
• Click Save rules.

In the Relyance AI application:

• Login to your Relyance Admin account.
• Navigate to the Settings Menu in the bottom left-hand side.
• Select Integrations.
• Find the Amazon RDS integration card and click it to open its connections.
• On the Authentication step, choose Direct Connection under Authentication Method.
• Paste the Endpoint, Port, Engine Type (mysql, mariadb, postgres or sqlserver), Database Username, and Password into their respective fields.
• Fill in the Crawler Configuration field to scope which databases and tables are crawled (see Relyance Crawler above).
• Additional Features:
  • Select the Enable Data Inspection checkbox if you wish Relyance also to inspect the data. Adjust the Sampling Percent and Min Likelihood as needed.
  • For more information on Relyance features, please refer to this help center article: here.
• Click Connect.
• At this point, you should see the following result on the Vendor Integrations page:
• Congratulations, you are now connected to Amazon RDS.

AWS RDS via IAM-based Authentication

Details

In order to integrate Relyance with AWS Lambda, Relyance will need to assume a role on your behalf. Role assumption in AWS allows entities (like IAM users, services, or even external identities) to take on an IAM role, granting them temporary permissions to perform specific actions on specific resources without having to attach permissions directly to their identity. By assuming a role, one gets temporary security credentials to act with the permissions of the role, ensuring a flexible and secure way to delegate and segregate duties without distributing long-lived credentials. There are two necessary preconditions that must be met for Relyance AI to assume a role.

• It needs to have permission to use the sts:AssumeRole action for the specific role.
• The role must have a trust policy that allows Relyance AI to use it.

Relyance Crawler

Relyance RDS integrations utilize a crawler that will list all RDS instances in a specific region. We will require the same Database User to be available across all of them in order to connect. You can control the behavior of the crawler via Crawler Configuration field.

If you have specific RDS instances that you want Relyance to scan, add them to allow_list; alternatively if you want to scan all RDS instances except a specific set, add them to block_list.

{

"allow_list": [

""

], "block_list": [

""

]

}

In AWS Console:

When you connect your Amazon RDS to Relyance you will need your Role ARN, External ID, Region, Database User. Follow the below steps to create them.

• Log in to your AWS management console.
• Copy your Account ID from the top-right profile dropdown menu.
• We suggest that you utilize IAM-based authentication since it uses AWS IAM to generate a short lived password that can be used for establishing a SQL connection.
• Use IAM-based Authentication:
• Navigate to the IAM console and create a new policy.

Switch editor to JSON and enter: {

"Version": "2012-10-17", "Statement": [

{

"Sid": "RelyanceIamDbAccess", "Effect": "Allow", "Action": "rds-db:connect", "Resource": "arn:aws:rds-db::{{ YOUR_AWS_ACCOUNT }}:dbuser:/relyance_user"

}, {

"Sid": "RelyanceRdsCrawler", "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*"

}

]

}

• Name the policy (e.g. RelyanceRDSAccessPolicy) - and click Create Policy.
• Create a new Role for Relyance to list and access your AWS RDS resources:
• Navigate to IAM > Roles section to create a new role and click on “create role”.
• Select Trusted Entity “AWS Account” and choose “Another AWS account” and use Relyance account ID: “580082088342”
• Enable “Require external ID” and fill in an External ID. This is a secret you only use to integrate with Relyance.
• The external ID is a secret that you will use and enter in the Relyance platform for additional security. While it could be anything, we recommend using a secret generator such as https://www.uuidgenerator.net/version4 to generate.
• In the next page, select RelyanceRDSAccessPolicy which gives Relyance permission to list rds instances and use IAM-based authentication.
• Give the Role a meaningful name (eg: RelyanceRdsRole ) and a description and follow the wizard to create the role.
• Note the Role Name to be used in Relyance.
• Once the role is created, click on the Trust Relationships tab and update the trust policy to the following:

{

"Version": "2012-10-17", "Statement": [

{

"Effect": "Allow", "Principal": {

"AWS": "arn:aws:iam::580082088342:user/tenant-prod-access"

}, "Action": "sts:AssumeRole", "Condition": {

"StringEquals": {

"sts:ExternalId": "<< external ID >>"

}

}

}

]

}

Ensure you replace '<< external ID >>' with the external ID you created previously.

In the Relyance AI application:

• Login to your Relyance account.
• Navigate to the Settings Menu in the bottom left-hand side.
• Select Integrations.
• Click on the Vendor Integration tab.
• Find the Amazon RDS integration card and click it to open its connections.
• On the Authentication step, choose IAM-based Auth under Authentication Method.
• Paste the Role ARN, External ID, Region and (optionally) Database User into their respective fields.
• Fill in the Crawler Configuration field to scope which databases and tables are crawled.
• Additional Features:
  • Select the Enable Data Inspection checkbox if you wish Relyance also to inspect the data.
  • Adjust the Sampling Percent and Min Likelihood as needed.
  • For more information on Relyance features, please refer to this help center article: here.
• Click Connect
• At this point, you should see the following result on the Vendor Integrations page:
• Congratulations, you are now connected to Amazon RDS

Choosing a method

IAM-based Auth is the one to prefer: RDS mints a short-lived token per connection, so there is no long-lived password sitting in a credential store and nothing to rotate. Choose AWS Lambda when the instance has no public endpoint and cannot get one — the function runs inside the VPC and Relyance never needs network reach to the database. Choose Direct Connection only when neither is possible.

Verify the connection is really working

Two layers of authorisation apply, and they fail at different moments:

1. Authentication succeeds and the scan finds nothing. This is almost always the database-side grants. IAM gets Relyance connected; SELECT and SHOW VIEW are what let it read. A user with no grants can log in perfectly and see no tables.
2. A connection timeout rather than a permission error points at network reach, not credentials: the security group must admit the Relyance egress IPs for the region hosting your tenant. If the instance is private and must stay private, switch to the AWS Lambda method rather than opening it up.
3. IAM-based Auth fails at Authenticate. The database user has to exist and be created for IAM authentication — AWSAuthenticationPlugin on MySQL/MariaDB. An ordinary password user with the same name will not authenticate by token.
4. Fewer schemas than expected. The Crawler Configuration is the scope; deny entries win over allow entries.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

AWS IAM role — AWS Lambda

resource "relyance_integration_connection" "aws_rds_0" {
  vendor = "aws_rds"
  name   = "<your connection name>"

  auth = {
    method = "iam-role-aws-lambda"
    params = {
      account_id = "<account_id>"
      role_name = "<role_name>"
      region = "<region>"
      lambda_function_name = "<lambda_function_name>"
      crawler_rules = jsonencode({
        allow_list = [
          ""
        ]
        block_list = [
          ""
        ]
      })
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_rds_external_id
      use_iam_based_auth = "true"
      secret_name = var.aws_rds_secret_name
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}

Username & password

resource "relyance_integration_connection" "aws_rds_1" {
  vendor = "aws_rds"
  name   = "<your connection name>"

  auth = {
    method = "username-password"
    params = {
      endpoint = "<endpoint>"
      port = "<port>"
      crawler_rules = jsonencode({
        allow_list = [
          ""
        ]
        block_list = [
          ""
        ]
      })
      engine = "<engine>"
      username = "<username>"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      password = var.aws_rds_password
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}

AWS IAM role — IAM-based Auth

resource "relyance_integration_connection" "aws_rds_2" {
  vendor = "aws_rds"
  name   = "<your connection name>"

  auth = {
    method = "iam-role-based"
    params = {
      role_arn = "<role_arn>"
      region = "<region>"
      crawler_rules = jsonencode({
        allow_list = [
          ""
        ]
        block_list = [
          ""
        ]
      })
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_rds_external_id
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}