A 15-minute token doesn't mean a 15-minute connection

RDS IAM authentication tokens are valid for 15 minutes, which makes them sound like a 15-minute exposure window. On their own, they aren't.

The token is only checked when a connection is opened. A connection opened with a valid token stays open after the token expires, so a pooled connection that lives for hours keeps its database access for hours.

What to do:

• Cap connection lifetime so connections are recycled well inside the token's lifetime: for example SQLAlchemy's pool_recycle, or max_lifetime in psycopg's connection pool.
• Generate a fresh token for every new connection, never cache one.
• Still pool connections rather than opening one per query: AWS documents a practical limit on new IAM-authenticated connections per second.

Short-lived credentials only shrink your exposure window if your connections are short-lived too.

More context: Stop Giving Your AI Agents a Database Password