Ditching Passwords: IAM Authentication for RDS
Static database passwords are a liability sitting in a config file somewhere. IAM database authentication lets an EC2 instance's own role generate a short-lived token and use it as the password instead.
No secret to rotate, no secret to leak - just a signed token valid for fifteen minutes.