Connecting Amazon RDS to OwlAI, the easy way

#No copying from the console, and no account keys changing hands

Your customer database runs on Amazon RDS. To connect it to an AI, someone in IT opens the AWS console, copies the endpoint and port, downloads that region's certificate file, and pastes each value into the AI's admin screen. One wrong character in the address and the connection fails. To spare them the work, a vendor might say, "Give us an AWS access key and we'll read the list ourselves." Then security steps in: the keys to the company's cloud account do not go to an outside company.

In SaaS, you do neither. You approve, in your own AWS console, a role that can only read your database list. OwlAI reads that list once and shows it, and your admin picks a database from it. The endpoint, port, and certificate are filled in, and no account keys change hands. Only the database password is typed by a person.

#Approve a role that only reads the list, instead of handing over keys

When your admin clicks Connect with Amazon RDS, a new tab opens the stack creation page in the AWS console. OwlAI has already filled in the settings; someone on your side reviews them and clicks Create stack. The stack creates one role. That role can read your RDS and Aurora list and the network details needed to connect, and nothing else. Once its expiry passes, even OwlAI cannot use it.

OwlAI uses the role to read the database list in your account once. It has no permission to create or change anything there. If you register several databases from the same account, you pick them one after another from that same list. When you're done, you delete the stack in the AWS console as the screen suggests, and the role goes with it.

#Pick a database and the address and certificate fill in

Pick a database from the list and the registration form fills in its address and port. Encryption in transit (TLS) is set to required, and the server certificate is checked against that region's RDS certificate. Your admin enters only the account and password, tests the connection, and registers it. The AWS role has no permission to read database passwords, so you decide from the start which database account the AI queries with.

If the server moves later and the address changes, you don't register it again from scratch. Import again lets you pick the same database, fills the new address into the same connection, and keeps the analysis and permission settings you've built up.

#For a private database, the bastion goes in your account too

After picking a database, you choose how to reach it. A database reachable from outside connects over its public address, and its security group opens only to the OwlAI address shown on screen, not to every address. If you already run a bastion (a relay server in front of the private network), you register the connection through it.

If the database sits in a private subnet with no bastion to go through, OwlAI also fills in a stack that builds one. Before anything is created, the screen shows the instance type and an estimated monthly cost; your admin checks them and creates the stack in your own console. That bastion opens a path to the one database you picked (“The bastion gets one key line that only forwards to the database, not an account”) and accepts connections only from OwlAI's server addresses. Once the bastion is ready, a registration form opens with the route through it already filled in. “How do you connect your company database securely?” covers how the tunnel and encryption work.

The bastion is a resource in your account, and its cost is billed to that account. OwlAI does not delete it for you; when no connection uses it anymore, you delete the bastion stack in the console.

#What to settle before you connect RDS

Decide these before importing an RDS connection:

• who approves stack creation in the AWS console (they need permission to create roles)
• the read-only database account the AI will use, and who enters its password
• for each database, whether to connect over a public address, an existing bastion, or a new bastion
• who approves a new bastion's monthly cost, and who deletes it once it's no longer needed
• who deletes the lookup stack once registration is done