> For the complete documentation index, see [llms.txt](https://docs.smaq.io/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.smaq.io/documentation/connections/sql-databases/aws-rds.md).

# AWS RDS

Connect a PostgreSQL or MySQL database hosted on Amazon RDS — including the network and security setup SMAQ needs.

This guide covers the AWS-specific pieces of connecting a PostgreSQL or MySQL database running on Amazon RDS. The actual SMAQ connection form steps are the same as any [SQL database](/documentation/connections/sql-databases.md).

### Step 1 — Collect connection details from RDS

In the AWS Console:

1. **RDS → Databases**.
2. Click your DB instance.
3. From the **Connectivity & security** tab, copy the **Endpoint** (e.g. `acme-prod.abc123.us-east-1.rds.amazonaws.com`) and **Port** (5432 for Postgres, 3306 for MySQL).
4. Note the **DB name** (Configuration tab).

> **\[Screenshot needed]** RDS instance Connectivity & security tab with Endpoint and Port highlighted.

### Step 2 — Make the database reachable from SMAQ

SMAQ connects from a fixed set of outbound IPs. Either:

* **Option A — Add SMAQ's IPs to your RDS security group** (recommended for production)
  1. Get SMAQ's outbound IPs from **<info@smaq.io>**.
  2. RDS → DB instance → Connectivity & security → VPC security group.
  3. Click the security group → Inbound rules → Edit.
  4. Add rules: **PostgreSQL (5432)** or **MySQL (3306)** from each of SMAQ's IPs.
  5. Save.
* **Option B — VPC peering** (enterprise only) Contact <info@smaq.io> to set up VPC peering between SMAQ's VPC and yours.

> **\[Screenshot needed]** RDS security group inbound rules with SMAQ IPs added.

### Step 3 — Create a read-only DB user

Don't give SMAQ your master DB password. Create a least-privilege user:

**Postgres:**

```sql
CREATE USER smaq_readonly WITH PASSWORD 'long-random-string';
GRANT CONNECT ON DATABASE your_db TO smaq_readonly;
GRANT USAGE ON SCHEMA public TO smaq_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO smaq_readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO smaq_readonly;
```

**MySQL:**

```sql
CREATE USER 'smaq_readonly'@'%' IDENTIFIED BY 'long-random-string';
GRANT SELECT ON your_db.* TO 'smaq_readonly'@'%';
FLUSH PRIVILEGES;
```

### Step 4 — Add the connection in SMAQ

1. SMAQ project → **Data Source → Add data source**.
2. Pick **PostgreSQL** or **MySQL**.
3. Fill in:
   * **Host**: the RDS endpoint
   * **Port**: 5432 or 3306
   * **Database**: your DB name
   * **Username**: `smaq_readonly`
   * **Password**: the password you set
   * **SSL mode**: Require
4. Click **Test connection**. SMAQ should report the tables it discovered.
5. Name and click **Connect**.

> **\[Screenshot needed]** SMAQ connection form filled in for an RDS Postgres instance.

### Troubleshooting

* **Timeout** — security group isn't allowing SMAQ's IPs, or the RDS instance has Publicly accessible = No without VPC peering.
* **"SSL required" error** — set SSL mode to **Require** in SMAQ's connection form.
* **"Permission denied for table X"** — re-run the GRANT SELECT step. New tables won't be readable by default; the `ALTER DEFAULT PRIVILEGES` line above handles future tables.