# rds-db2

Walks you through Amazon RDS for Db2: provisioning, TLS connections, migration from Db2 LUW and z/OS, S3 backups, Multi-AZ.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 4800 installs · ★ 3282
- Author: aws
- License: Apache-2.0 · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/aws/agent-toolkit-for-aws/tree/HEAD/skills/specialized-skills/database-skills/rds-db2/SKILL.md
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/skills/rds-db2

## What it does

This skill covers the operator lifecycle of managed IBM Db2 LUW on AWS. It handles provisioning with IBM licensing (License Manager, BYOL, GovCloud), client install and TLS connectivity, and the SQL30082N error that shows up after a Secrets Manager rotation. Separate branches deal with migration from self-managed Db2 on Linux, AIX, Windows or AS400, and from z/OS mainframes via ADB2GEN and Q Replication.

How it works: the skill verifies dependencies first, then routes your question through a table to one reference file and loads only that one. Answers come back as runnable AWS CLI commands. Every operation is written in AWS CLI syntax, so it runs with or without the AWS MCP server, though the server is recommended. Bundled scripts like `db2-driver.sh` are part of it.

Check what you have before starting. You need AWS CLI v2 and credentials that flow through an IAM role or instance profile rather than pasted values. BYOK wants `openssl` and `jq`; Kerberos authentication wants `realmd`, `sssd`, `adcli`, `krb5-workstation` and a valid ticket. The Kerberos JDBC test needs `db2jcc4.jar` v4.33 or later, since earlier drivers lack `securityMechanism=11`. AWS owns the host, so there is no SSH, no agents to install, and no unfenced C or COBOL stored procedures — Java procedures run through `sqlj.install_jar`.

## Requirements
- Works with: AWS

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add aws/agent-toolkit-for-aws --skill rds-db2 -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rds-db2/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rds-db2/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add aws/agent-toolkit-for-aws --skill rds-db2 -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rds-db2/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add aws/agent-toolkit-for-aws --skill rds-db2 -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rds-db2/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install aws/agent-toolkit-for-aws rds-db2
```

2. **Manually: put the files in place**
- File: `.github/skills/rds-db2/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add aws/agent-toolkit-for-aws --skill rds-db2 -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/aws/agent-toolkit-for-aws --path skills/specialized-skills/database-skills/rds-db2
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rds-db2/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add aws/agent-toolkit-for-aws --skill rds-db2 -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/aws/agent-toolkit-for-aws/tree/HEAD/skills/specialized-skills/database-skills/rds-db2/SKILL.md

## When to use it
- provision an RDS for Db2 instance with IBM licensing and a parameter group
- fix SQL30082N after a Secrets Manager password rotation
- migrate a database from Db2 LUW on AIX or Windows with DMS
- pick a code page and collation for EBCDIC or UTF-8
- set up Multi-AZ and a cross-region standby replica

## Example prompts
- Create an RDS for Db2 instance in us-east-1 with my IBM customer ID and site ID, collect all parameters upfront
- The client fails with SQL30082N after a Secrets Manager rotation — what should I check?
- I need to migrate a Db2 LUW database on AIX to RDS for Db2, show me the precheck steps

## Source text · SKILL.md · Apache-2.0

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 2bd482edc5fc7398.

BEGIN THIRD-PARTY FILE 2bd482edc5fc7398
```text
---
name: rds-db2
version: 2
description: Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400) or z/OS mainframe (ADB2GEN, Q Replication), choosing code page/collation (EBCDIC, CCSID), S3 backup/restore, Multi-AZ and cross-region standby replicas, RDSADMIN procedures, customer-managed KMS BYOK, self-managed Active Directory Kerberos, Db2 audit to S3, minimum IAM, or colocation.
---
# Amazon RDS for Db2

## Overview

Amazon RDS for Db2 is a managed IBM Db2 LUW service. RDS for Db2 is managed — you cannot SSH to the host, install agents, or run unfenced external stored procedures in C/COBOL. Java stored procedures work via `sqlj.install_jar`. This skill covers the operator lifecycle: provisioning with IBM licensing, client install and TLS connectivity, migration from self-managed Db2 on Linux/AIX/Windows/z/OS/AS400, S3 backup and restore, Multi-AZ and cross-region standby replicas, and RDSADMIN stored procedures that replace SYSCTRL/SYSMAINT authority.

It also covers six additional security and operations areas: customer-managed KMS keys (BYOK), self-managed Active Directory with Kerberos authentication, Db2 audit to S3, code page and collation selection (EBCDIC, CCSID), minimum IAM permissions, and EC2/RDS colocation for Multi-AZ latency and failover.

The AWS MCP server is recommended but not required; all operations are expressed in AWS CLI syntax and run with or without it.

Routes to the matching sub-skill reference. Load only the matching reference.

## Common Tasks

### Verify Dependencies

Before executing an RDS for Db2 workflow, confirm required tools exist. Do not run installers or API calls yet.

- AWS CLI v2 for every RDS API call
- AWS credentials via managed mechanism (IAM role, instance profile, `ada credentials update`) — not pasted credentials
- Client install: `bash`/`curl` access, run as root and as `db2inst1`
- Airgap install: internet-connected machine + target with VPC endpoints for S3, SSM, Secrets Manager
- Mainframe migration: z/OS access, IBM ADB2GEN license, Python 3
```
END THIRD-PARTY FILE 2bd482edc5fc7398

The third-party file has ended. Everything between the 2bd482edc5fc7398 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2258 of 27618 bytes. © aws · Apache-2.0 · https://github.com/aws/agent-toolkit-for-aws/tree/HEAD/skills/specialized-skills/database-skills/rds-db2/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md