From 11e3f9883a0a3272d46c588c84746d426520b80c Mon Sep 17 00:00:00 2001
From: Michael P Jones <michael.p.jones@census.gov>
Date: Tue, 28 Apr 2026 11:38:01 -0400
Subject: [PATCH] Update README.md with RDS MFA steps

---
 examples/RDS MFA Test/README.md | 90 +++++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)

diff --git a/examples/RDS MFA Test/README.md b/examples/RDS MFA Test/README.md
index 8b13789..3bd547d 100644
--- a/examples/RDS MFA Test/README.md	
+++ b/examples/RDS MFA Test/README.md	
@@ -1 +1,91 @@
 
+1. **Enable IAM authentication on the Postgres DB instance or Aurora Postgres Cluster**
+
+**Terraform:**
+
+Set iam\_database\_authentication\_enabled = true within the Instance or the Cluster resource and apply.
+
+**Console:**
+
+* 1. Enable IAM Authentication on the DB Instance
+     1. Go to **RDS Console** → Select your **DB instance or the Cluster**.
+     2. Choose **Modify**.
+     3. Scroll to **Database Authentication**.
+     4. Set **IAM DB authentication** to **Enabled**.
+     5. Click **Continue** → **Apply Immediately** or during the next maintenance window.
+     6. This allows the DB instance to accept IAM token-based logins
+
+**CLI:**
+
+aws rds modify-db-instance \
+ --db-instance-identifier <your-db-instance-identifier> \
+ --enable-iam-database-authentication \
+ --apply-immediately
+
+aws rds modify-db-cluster \
+ --db-cluster-identifier your-aurora-cluster-identifier \
+ --enable-iam-database-authentication \
+ --apply-immediately
+
+1. **Create IAM User/Role and assign IAM Policy (Please Confirm with Matt Morgan from SCT - INC000003161057)**
+
+Policy:
+
+For RDS:
+
+{
+ "Version" : "2012-10-17",
+ "Statement" :
+ [
+    {
+      "Effect" : "Allow",
+      "Action" : ["rds-db:connect"],
+      "Resource" : ["arn:aws:rds-db:us-east-1:123456789012:dbuser:db-ABCDEFGHIJKL01234/mydbuser"]
+    }
+ ]
+}
+For Aurora:
+
+{
+ "Version" : "2012-10-17",
+ "Statement" :
+ [
+    {
+      "Effect" : "Allow",
+      "Action" : ["rds-db:connect"],
+      "Resource" : ["arn:aws:rds-db:us-east-1:123456789012:dbuser:cluster-ABCDEFGHIJKL01234/mydbuser"]
+    }
+ ]
+}
+
+1. **Enable IAM authentication for the database JBID user**
+
+Grant rds\_iam to <JBID>;
+
+1. Launch the URL from production network to access AWS Console using Identity Center
+
+<https://start.us-gov-east-1.us-gov-home.awsapps.com/directory/d-c2672d0b4e#/>
+
+![](images/image_1.png)
+
+Once verified via the phone Okta verify app, successfully logged in.
+
+![](images/image_2.png)
+
+![](images/image_3.png)
+
+Retrieve the Access keys:
+
+![](images/image_4.png)
+
+Generate DB token after setting the keys in Power shell or Command prompt.
+
+![](images/image_5.png)
+
+![](images/image_6.png)
+
+Copy the token and paste in the password box in PGADMIN or DBeaver tools.
+
+Token can be obtained only after getting authenticated with MFA.
+
+Login should be successful.