I have a very standard use case. (I already explored on internet and went through various AWS docs but didn’t find concrete and clear answers for my questions.)

• I have a RDS Postgres instance and I want to use RDS proxy to access this RDS instance.

• I have created 5 databases on this RDS instance

• I have different application pods (running in AWS EKS cluster) which connects to different databases created on the same RDS instance

• The Database creds (username and password) are stored in k8s secrets and are mounted to respective application pods.

Now, When I tried creating RDS proxy, I found that It is mandatory to create(stored in AWS Secrets Manager) and provide the secrets ARN during RDS proxy creation.

My assumption was – With RDS proxy we will get proxy endpoint and simply replace this end-point in my application pods, The DB username and password I already have using k8s secrets.

Questions :

1. Is it mandatory to also create and store the DB secrets in AWS secrets Manager to use RDS proxy ?

2. If RDS proxy can already access to RDS instance (using provided IAM role), then can I not simply connect to RDS instance using RDS proxy endpoint with the same DB username and password which my application pods can get from k8s secrets ?

3. Let’s say If It is mandatory to create secrets and store in AWS secrets manager to user RDS proxy – It means I have to create 5 secrets for my 5 application databases ?

4. Can I not simply skip to create and store DB secrets in AWS secrets manager too to use RDS proxy ?

Thanks in advance.