> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/aws/rds.md).

# RDS

## Requirements

<table><thead><tr><th width="214.3515625">Name</th><th>Description</th></tr></thead><tbody><tr><td>IAM Edit Permission</td><td>To attach RDS read and/or write permissions to the Teleskope IAM role</td></tr><tr><td>Database Admin User</td><td>To create a read and/or write database user for each RDS cluster you'd like us to scan</td></tr><tr><td>Network Access</td><td>Teleskope must be able to reach each instance endpoint on its database port. See <a href="#network-access">Network Access</a> for the public and private subnet paths.</td></tr></tbody></table>

####

{% stepper %}
{% step %}

#### Grant Teleskope AWS scopes

**Grant the TeleskopeRole read permission**

Teleskope requires read access to automatically discover all of your RDS clusters and instances.

Attach the `AmazonRDSReadOnlyAccess` permission to the TeleskopeRole identity you created.

{% code title="RDS Read Only Terraform" %}

```json
resource "aws_iam_role_policy_attachment" "rds_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess"
}
```

{% endcode %}

**Grant the TeleskopeRole Read and Write IAM Access to RDS (Optional)**

Teleskope requires write access to perform remediation actions like tagging.

Attach the `AmazonRDSFullAccess` to the Teleskope role you created.

{% code title="RDS Read/Write Terraform" %}

```
resource "aws_iam_role_policy_attachment" "rds_policy" {
  role       = "TeleskopeRole"
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSFullAccess"
}
```

{% endcode %}
{% endstep %}

{% step %}
**Create a Database User for Teleskope**

For each RDS cluster you would like to scan using Teleskope, you will need to:

1. Create a database user for authentication with [Username and Password](/connectors/aws/rds/username-and-password.md), or [IAM Auth](/connectors/aws/rds/iam-auth.md).
2. Grant the user permission to read/write in the cluster
   {% endstep %}

{% step %}
**Confirm network access**

Set up the network path that matches your deployment — see [Network Access](#network-access) below.
{% endstep %}

{% step %}
**Enroll the Cluster in the Teleskope UI**
{% endstep %}
{% endstepper %}

## Network Access

The IAM role covers discovery only: Teleskope lists your clusters and instances through the AWS API. Crawling and scanning open a database connection to each instance endpoint, so Teleskope must be able to reach that endpoint on its database port. Which path applies depends on whether the instance is publicly accessible.

### Publicly accessible instances

Allow inbound traffic on the database port from Teleskope's egress IP addresses in the instance's security group. Teleskope provides the full IP set.

{% hint style="warning" %}
**Warning:** Allowlist the entire IP set, not a single address. Individual egress IPs can change during infrastructure updates.
{% endhint %}

### Instances in private subnets

A private endpoint is not reachable from outside your VPC. Choose one of the following paths.

{% tabs %}
{% tab title="VPC Peering" %}
Teleskope connects to the instance endpoint directly over a VPC peering connection.

1. Provide Teleskope the VPC ID containing your RDS instances. Teleskope initiates a peering request from its VPC and shares its AWS account ID and VPC CIDR.
2. Accept the peering connection in your console (VPC → Peering connections).
3. In the route tables used by your RDS subnets, add a route to the Teleskope VPC CIDR via the peering connection.
4. In the instance's security group, allow inbound traffic on the database port from the Teleskope VPC CIDR.

Peering requires non-overlapping CIDRs between your VPC and Teleskope's. Teleskope confirms this before sending the request.
{% endtab %}

{% tab title="SSH Tunnel (Bastion)" %}
Teleskope connects through a bastion host you operate in a public subnet.

1. Launch an EC2 instance in a public subnet to serve as the SSH tunnel bastion host.
2. Place the Teleskope-provided public key in `~/.ssh/authorized_keys` on the bastion user:

   ```bash
   echo "<TELESKOPE_PUBLIC_KEY>" >> ~/.ssh/authorized_keys
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys
   ```
3. Allow inbound SSH (port 22) from Teleskope's egress IP addresses in the bastion's security group. Teleskope provides the IP set.
4. Assign an Elastic IP (EIP) to the bastion host.
5. Adjust route tables and security groups so the bastion can reach the RDS instances on their database ports.
6. Provide Teleskope with the bastion username and the bastion Elastic IP.
   {% endtab %}
   {% endtabs %}