Stop storing database passwords in secrets

A database password in a Kubernetes Secret has to be created, synced, rotated and kept out of Git. Every one of those steps is a place for it to leak.

With IAM database authentication and IRSA (IAM Roles for Service Accounts) , there is no password to store. The pod proves its identity to AWS, gets a short-lived token, and uses that token as the Postgres password.

This post wires it up with Terraform on Aurora PostgreSQL 17 and EKS.

How it works

Pod (ServiceAccount backend-sa) │ 1. projected OIDC token ▼ AWS STS verifies the token against the EKS OIDC provider │ 2. temporary credentials for the IAM role ▼ Pod calls rds:GenerateDBAuthToken → token valid for 15 minutes │ 3.…