PHPackages                             tacticmedia/rds-auth-middleware - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. tacticmedia/rds-auth-middleware

ActiveLibrary

tacticmedia/rds-auth-middleware
===============================

Doctrine DBAL driver middleware for Amazon RDS: IAM token authentication and master-password refresh from Secrets Manager.

00PHPCI passing

Since Aug 14Pushed todayCompare

[ Source](https://github.com/tacticmedia/rds-auth-middleware)[ Packagist](https://packagist.org/packages/tacticmedia/rds-auth-middleware)[ RSS](/packages/tacticmedia-rds-auth-middleware/feed)WikiDiscussions main Synced today

READMEChangelogDependenciesVersions (1)Used By (0)

Doctrine middleware for RDS authentication
==========================================

[](#doctrine-middleware-for-rds-authentication)

[![codecov](https://camo.githubusercontent.com/4aa212221928227da27525e47d706c720f95c8302276f444b57f1b643598f701/68747470733a2f2f636f6465636f762e696f2f67682f7461637469636d656469612f7264732d617574682d6d6964646c65776172652f67726170682f62616467652e7376673f746f6b656e3d585a494e4e3548584f42)](https://github.com/tacticmedia/rds-auth-middleware)

**Important**: Symfony users should install [`tacticmedia/rds-auth-bundle`](https://github.com/tacticmedia/rds-auth-bundle) instead, which configures this package through bundle configuration.

A Doctrine DBAL driver middleware that supplies the database credential for an Amazon RDS instance. At connection time it selects one of three modes:

- When **IAM username** is configured: replace the user and password with a short-lived [RDS IAM authentication token](docs/iam-authentication.md).
- When the **Secret ARN** is configured: connect with the configured password; when the database rejects it, read the current password from [Secrets Manager](docs/managed-password.md) and retry once. This recovers from automated RDS `ManageMasterUserPassword` rotation without a deployment.
- Neither configured: pass the connection parameters through unchanged.

Before you choose IAM authentication, read its [limitations](docs/iam-authentication.md#limitations): AWS requires 300 to 1000 MiB extra database memory for it, which rules out small instances. The managed password mode exists for exactly those deployments.

Installation
------------

[](#installation)

```
composer require tacticmedia/rds-auth-middleware
```

Quick start
-----------

[](#quick-start)

```
use Doctrine\DBAL\Configuration;
use Doctrine\DBAL\DriverManager;
use TacticMedia\RdsAuth\RdsAuthMiddleware;
use TacticMedia\RdsAuth\RdsIamTokenProvider;
use TacticMedia\RdsAuth\RdsSecretPasswordProvider;

$region = getenv('AWS_REGION') ?: 'us-east-1';

$middleware = new RdsAuthMiddleware(
    new RdsIamTokenProvider($region),
    new RdsSecretPasswordProvider($region),
    getenv('RDS_IAM_USERNAME') ?: null,          // null disables the IAM path
    getenv('RDS_SECRET_ARN') ?: null,            // null disables the refresh path
    $cachePool,                                  // any PSR-6 pool; omit to disable caching
);

$configuration = new Configuration();
$configuration->setMiddlewares([$middleware]);

$connection = DriverManager::getConnection($params, $configuration);
```

Documentation
-------------

[](#documentation)

- [Getting started](docs/getting-started.md) - requirements, installation, wiring, mode selection
- [IAM token authentication](docs/iam-authentication.md) - token flow, AWS-side setup, TLS, limitations
- [Managed password](docs/managed-password.md) - Secrets Manager rotation recovery, failure detection
- [Caching](docs/caching.md) - PSR-6 behaviour, TTLs, invariants, key format
- [Database engines](docs/database-engines.md) - engine detection, ports, TLS per engine
- [Architecture](docs/architecture.md) - class map, connection flow, design decisions
- [Testing](docs/testing.md) - suites, Docker services, environment variables, fixtures

Development
-----------

[](#development)

```
composer test               # PHPUnit unit suite
composer test:integration   # PHPUnit integration suite, needs Docker services
composer qa                 # rector, cs, stan, test in sequence
```

See [docs/testing.md](docs/testing.md) for the Docker services, environment variables, and reference fixtures.

License
-------

[](#license)

MIT. See [LICENSE](LICENSE).

###  Health Score

20

—

LowBetter than 12% of packages

Maintenance65

Regular maintenance activity

Popularity0

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity11

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

### Community

Maintainers

![](https://www.gravatar.com/avatar/a32d26426a5a46eb135149043845f075a5c1ff65c9436217b2a54d8e50de4e04?d=identicon)[janklan](/maintainers/janklan)

---

Top Contributors

[![janklan](https://avatars.githubusercontent.com/u/5463371?v=4)](https://github.com/janklan "janklan (7 commits)")

### Embed Badge

![Health badge](/badges/tacticmedia-rds-auth-middleware/health.svg)

```
[![Health](https://phpackages.com/badges/tacticmedia-rds-auth-middleware/health.svg)](https://phpackages.com/packages/tacticmedia-rds-auth-middleware)
```

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)