stackgate.ai
All integrations

Amazon RDS

Inspect RDS instances and Aurora clusters, read snapshots and engine logs, and run SQL against reachable MySQL/PostgreSQL endpoints via MCP.

Manual setup 11 tools

Overview

Connect Amazon RDS so AI clients can inspect RDS resources (DB instances, Aurora clusters, snapshots, events, engine logs) and run SQL against reachable MySQL, MariaDB, PostgreSQL, and Aurora endpoints.

This integration uses the Amazon RDS API with IAM access keys plus database credentials stored encrypted in stackgate.ai. AWS API usage is billed to your AWS account.

For S3 artifacts or CodeBuild logs tied to deployments, use Amazon S3 or AWS CodeBuild instead.

Prerequisites

  • An AWS account with RDS instances or Aurora clusters you want AI clients to inspect
  • For SQL tools: a network-reachable instance endpoint (PubliclyAccessible=true or equivalent) and a database user with appropriate grants
  • Supported SQL engines: MySQL, MariaDB, PostgreSQL, Aurora MySQL, Aurora PostgreSQL
  • A stackgate.ai account

Getting credentials

IAM access (control plane)

  1. In the AWS IAM console, create an IAM user (or reuse an automation user) with programmatic access.
  2. Attach a least-privilege policy. Example for read-only RDS inspection:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters",
                "rds:DescribeDBSnapshots",
                "rds:DescribeDBClusterSnapshots",
                "rds:DescribeEvents",
                "rds:DescribeDBLogFiles",
                "rds:DownloadDBLogFilePortion"
            ],
            "Resource": "*"
        }
    ]
}
  1. Create an access key and copy the key ID and secret.

Database user (SQL tools)

Create a dedicated database user on your RDS instance — prefer a read-only user for query_sql and a separate user with limited DML/DDL grants if you need execute_sql.

PostgreSQL example:

CREATE USER app_readonly WITH PASSWORD 'your-secure-password';
GRANT CONNECT ON DATABASE analytics TO app_readonly;
GRANT USAGE ON SCHEMA public TO app_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO app_readonly;

MySQL example:

CREATE USER 'app_readonly'@'%' IDENTIFIED BY 'your-secure-password';
GRANT SELECT ON analytics.* TO 'app_readonly'@'%';

Ensure the instance security group allows inbound traffic on the database port from the internet if you use SQL tools from the cloud hub.

Activate in stackgate.ai

  1. Open My Integrations → Amazon RDS.
  2. Click Activate and enter:
    • access key ID, secret access key, AWS region
    • Optional default DB instance identifier
    • database username and password (required for SQL tools)
    • Optional default database name and PostgreSQL SSL mode (require recommended)

You can reuse the same IAM user as Amazon S3, AWS CloudWatch, or AWS CodeBuild with a merged policy.

Using with AI clients

  • Dedicated endpoint: POST /mcp/rds with a Sanctum bearer token
  • Private gateway: one config for all integrations — use rds__* namespaced tools

Control-plane workflow:

  1. list_db_instances / list_db_clusters — discover resources
  2. get_db_instance / get_db_cluster — endpoint, engine, status
  3. describe_db_events — recent maintenance or failure events
  4. list_db_snapshots / list_db_cluster_snapshots — backup inventory
  5. list_db_log_files → download_db_log_portion — engine logs

SQL workflow:

  1. get_db_instance — confirm publicly_accessible and engine
  2. query_sql — read-only SELECT queries
  3. execute_sql — DDL/DML only after explicit user confirmation

See Documentation for HTTP authentication and private gateway setup.

Troubleshooting

  • 422 integration not configured — complete IAM access key fields in My Integrations.
  • 403 / AccessDenied from AWS — verify IAM policy includes the required rds:Describe* actions.
  • db_instance_identifier is required — pass db_instance_identifier or set a default DB instance in My Integrations.
  • Database username and password are required — add db_username and db_password for SQL tools.
  • Not publicly accessible — SQL tools require a network-reachable endpoint from the cloud hub. Private VPC-only instances are not supported in v1.
  • Unsupported RDS engine — SQL tools support MySQL, MariaDB, PostgreSQL, and Aurora variants only.
  • ThrottlingException / Rate exceeded — paginate with marker and avoid rapid repeated describe calls.
  • Connection timeout on SQL — check security groups, PubliclyAccessible, and that the instance status is available.

Available tools

  • list_db_instances

    List RDS DB instances in the connected AWS account and region.

  • get_db_instance

    Get details for one RDS DB instance: endpoint, engine, status, and accessibility.

  • list_db_clusters

    List Aurora DB clusters in the connected AWS account and region.

  • get_db_cluster

    Get details for one Aurora DB cluster including endpoints and member instances.

  • list_db_snapshots

    List RDS DB instance snapshots.

  • list_db_cluster_snapshots

    List Aurora DB cluster snapshots.

  • describe_db_events

    List recent RDS events for DB instances, clusters, or related resources.

  • list_db_log_files

    List engine log files for an RDS DB instance.

  • download_db_log_portion

    Download a portion of an RDS engine log file.

  • query_sql

    Run a read-only SELECT query against a reachable RDS instance (MySQL/MariaDB/PostgreSQL/Aurora).

  • execute_sql

    Execute DDL or DML SQL against a reachable RDS instance. Confirm destructive changes with the user first.

MCP endpoint: https://stackgate.ai/mcp/rds (HTTP) or via the private gateway.

Related workflows

Multi-integration playbooks that use Amazon RDS to solve concrete business outcomes.

Create account Documentation