# aws-rds

Cursor rule enforcing security standards, naming conventions, and connection pooling for AWS RDS database workflows.

- rule · `type=rule` · Cursor · ★ 3580
- Author: sanjeed5
- License: CC0-1.0 · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/sanjeed5/awesome-cursor-rules-mdc/tree/HEAD/rules-mdc/aws-rds.mdc
- Updated: 2026-05-19
- HTML: https://affpapa.org/en/nevibecode/rules/aws-rds

## What it does

This rule guides Cursor when writing database code and cloud policies for AWS RDS. It blocks hardcoded database passwords and plain environment variables, requiring AWS Secrets Manager with automatic credential rotation instead. For network configuration, it restricts access to specific VPC CIDR blocks and PrivateLink endpoints, forbidding open `0.0.0.0/0` security groups.

The instructions enforce clear SQL standards. Database identifiers must use `snake_case`, while functions and stored procedures take `PascalCase`. The rule bans `SELECT *` in queries to protect bandwidth. Every query must use parameters or prepared statements to stop SQL injection.

For transient environments like AWS Lambda, the rule demands Amazon RDS Proxy to manage connection pools. Direct schema modifications on production tables break replication and cause downtime during switchover.

## Requirements
- Works with: AWS

## Install

### Cursor (native platform)

**Manually: put the files in place**
- File: `.cursor/rules/aws-rds.mdc` — Frontmatter: description, globs, alwaysApply

### Claude Code

**Manually: put the files in place**
- File: `.claude/rules/aws-rds.md` — The paths frontmatter field limits the files: move globs from the source into paths

### Codex

**AGENTS.md**
- Codex reads AGENTS.md: paste the rule text there

### GitHub Copilot

**Manually: put the files in place**
- File: `.github/instructions/aws-rds.instructions.md` — The applyTo field sets which files it applies to: move globs from the source into applyTo

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/rules/aws-rds.md`

### Cline

**Manually: put the files in place**
- File: `.clinerules/aws-rds.md`

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/sanjeed5/awesome-cursor-rules-mdc/tree/HEAD/rules-mdc/aws-rds.mdc

## When to use it
- Retrieve database credentials safely via AWS Secrets Manager
- Block SQL injection vulnerabilities using parameterized queries
- Lock down network access to RDS instances within VPC boundaries
- Prevent connection exhaustion in serverless apps with RDS Proxy

## Example prompts
- Write a Python script to fetch RDS credentials from AWS Secrets Manager
- Create an IAM policy granting read-only access to our RDS cluster
- Draft a PostgreSQL table schema adhering to the project's snake_case convention

## Source text · aws-rds.mdc · CC0-1.0

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: d2e46002bae88afd.

BEGIN THIRD-PARTY FILE d2e46002bae88afd
````text
---
description: Definitive guidelines for secure, performant, and maintainable database development and operations with AWS RDS, emphasizing modern best practices and common anti-patterns.
globs: **/*
---
# aws-rds Best Practices

This guide outlines the definitive best practices for interacting with and managing AWS RDS instances. Adhere to these guidelines to ensure your database operations are secure, performant, and maintainable.

## 1. Security Best Practices

Security is paramount. Always assume your database is a target.

### 1.1. Manage Credentials with AWS Secrets Manager

Never hardcode database credentials or store them in environment variables directly. Use AWS Secrets Manager with automatic rotation enabled.

❌ BAD:
```python
# app.py
DB_USER = os.getenv("DB_USER")
DB_PASS = os.getenv("DB_PASS")
conn = psycopg2.connect(user=DB_USER, password=DB_PASS, host=DB_HOST)
```

✅ GOOD:
```python
import boto3
import json

def get_secret(secret_name):
    client = boto3.client('secretsmanager')
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response['SecretString'])

# app.py
secret = get_secret("your-rds-db-credentials")
DB_USER = secret['username']
DB_PASS = secret['password']
DB_HOST = secret['host']
conn = psycopg2.connect(user=DB_USER, password=DB_PASS, host=DB_HOST)
```
**Context**: Secrets Manager handles rotation, encryption, and secure retrieval, significantly reducing the risk of credential compromise.

### 1.2. Enforce Least Privilege with IAM

Control access to RDS API actions (create, modify, delete clusters, security groups, parameter groups) using IAM identities, not the root account. Grant only the minimum permissions required. Organize permissions with IAM groups.

❌ BAD:
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "rds:*",
            "Resource": "*"
        }
    ]
}
```
**Context**: This grants full access to all RDS resources, a massive security risk.

✅ GOOD:
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBSnapshots",
                "rds:Connect"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:ModifyDBInstance",
                "rds:DeleteDBInstance"
            ],
            "Resource": "arn:aws:rds:REGION:ACCOUNT_ID:db:my-specific-app-db"
        }
    ]
}
```
**Context**: This policy grants read-only access to all RDS resources and specific modification/deletion rights to a single, named DB instance.

### 1.3. Use Security Groups and VPC Endpoints

Restrict network access to your RDS instances using tightly scoped security groups. For private access from within your VPC, use VPC Endpoints (AWS PrivateLink).

❌ BAD:
```json
{
  "IpProtocol": "tcp",
  "FromPort": 5432,
  "ToPort": 5432,
  "IpRanges": [{"CidrIp": "0.0.0.0/0"}] // Allows access from anywhere
}
```

✅ GOOD:
```json
{
  "IpProtocol": "tcp",
  "FromPort": 5432,
  "ToPort": 5432,
  "IpRanges": [{"CidrIp": "10.0.0.0/16"}] // Allows access only from your VPC CIDR
}
```
**Context**: Only allow ingress from specific application servers, bastion hosts, or other trusted AWS services.

## 2. Code Organization and Structure

Maintain clean, readable, and version-controlled SQL.

### 2.1. Adopt Consistent Naming Conventions

Use `snake_case` for all database identifiers (tables, columns, indexes). Use `PascalCase` for stored procedures and functions.

❌ BAD:
```sql
CREATE TABLE User_Accounts (
    UserID INT PRIMARY KEY,
    UserName VARCHAR(255),
    EmailAddress VARCHAR(255)
);

-- Stored procedure
````
END THIRD-PARTY FILE d2e46002bae88afd

The third-party file has ended. Everything between the d2e46002bae88afd tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 3810 of 11963 bytes. © sanjeed5 · CC0-1.0 · https://github.com/sanjeed5/awesome-cursor-rules-mdc/tree/HEAD/rules-mdc/aws-rds.mdc

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md