/rds-db2

RDS for Db2 — Drivers, Kerberos, Multi-Instance

Connecting from Python, Java, and laptop clients; Kerberos/Active Directory auth; managing multiple RDS for Db2 instances from the same shell.

Python with SSL

import ibm_db

conn_str = (
    "DATABASE=RDSADMIN;"
    "HOSTNAME=<rds-endpoint>;"
    "PORT=50443;"
    "PROTOCOL=TCPIP;"
    "UID=<master-user>;"
    "PWD=<password>;"
    "Security=SSL;"
    "SSLServerCertificate=/path/to/<region>-bundle.pem;"
)
conn = ibm_db.connect(conn_str, "", "")

Download the cert bundle first:

curl -sL https://truststore.pki.rds.amazonaws.com/<region>/<region>-bundle.pem -o ~/<region>-bundle.pem

Java with SSL (no keystore)

Source: https://aws.amazon.com/blogs/database/create-an-ssl-connection-to-amazon-rds-for-db2-in-java-without-keystore-or-keytool/

With the IBM Db2 JDBC driver (db2jcc4.jar), point sslTrustStoreLocation at the PEM file — no keystore or keytool needed:

Properties props = new Properties();
props.setProperty("user", "<master-user>");
props.setProperty("password", "<password>");
props.setProperty("sslConnection", "true");
props.setProperty("sslTrustStoreLocation", "/path/to/<region>-bundle.pem");

Connection conn = DriverManager.getConnection(
    "jdbc:db2://<rds-endpoint>:50443/RDSADMIN:sslConnection=true;",
    props
);

See scripts/Db2SslTest.java for a runnable end-to-end example.

MacBook / laptop

Install IBM Db2 Data Server Driver Package (dsdriver) from IBM Fix Central or Passport Advantage:

source ~/dsdriver/bin/db2profile
db2 catalog tcpip node RDSNODE remote <rds-endpoint> server 50000
db2 catalog database <dbname> as RDSDB at node RDSNODE
db2 terminate
db2 connect to RDSDB user <master-user> using '<password>'

For SSL, download the bundle (same URL as above) and catalog with SSL parameters pointing to the PEM.

Kerberos / Active Directory

For self-managed Active Directory join and Kerberos authentication — AD permission delegation, the Secrets Manager secret keys, the --domain-fqdn/-ou/-auth-secret-arn/-dns-ips join flags, the AD port matrix, and the JDBC Kerberos connection (securityMechanism=11) with the bundled Db2KerberosConnection.java / db2-kerberos-test.sh test — see ad-kerberos.md.

Multi-instance workflow

db2client-configure.sh configures one instance at a time. Re-run for each:

# Configure instance 1
REGION=us-east-1 source db2client-configure.sh  # select end-to-end-trust

# Configure instance 2
REGION=us-east-1 source db2client-configure.sh  # select trp-test-by-ibm

# Switch between them in one session
db2_use end-to-end-trust
db2 "connect to RDSADMIN user admin using '$MASTER_USER_PASSWORD'"
db2 "select * from sysibm.sysdummy1"
db2 connect reset

db2_use trp-test-by-ibm
db2 "connect to RDSADMIN user admin using '$MASTER_USER_PASSWORD'"
db2 connect reset

db2_show_env   # confirm which instance is active

How db2_use actually works (important for understanding password rotation):

• Reads ~/.db2instances (populated by db2client-configure.sh for each instance you registered).
• Calls aws secretsmanager get-secret-value against the instance's secret to fetch the current master password (automatically handles secret rotation).
• If no secret is associated, falls back to ~/.need_password.
• If neither exists, prompts interactively.
• Rewrites ~/.db2env with the active instance's DSN, user, password.
• Prints the two connect commands to run.

So after a password rotation in Secrets Manager, the only thing you need to do is re-run db2_use <instance-id> — the helper picks up the new password automatically. You do not need to re-run db2client-configure.sh.

Files reference (quick)