AWS RDS IAM Auth

Spacelift self-hosted deployment uses a static RDS master password. Best practices and compliance requirements call for DB credentials to be regularly rotated, which AWS supports out of the box for Aurora clusters:

• https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html

Even better, AWS RDS/Aurora supports IAM database authentication, which uses short-lived (15-minute) authentication tokens instead of a stored password, and can be used together with master password rotation:

• Master password rotated regularly via AWS Secrets Manager, and used only for administrative/break-glass access

• Spacelift connects to the database for normal operation via a dedicated database user authenticated with IAM auth tokens, so no static password is used on the application's connection path

Note: the module already sets iam_database_authentication_enabled = true on the aws_rds_cluster resource, so the AWS-side prerequisite for IAM auth is already in place. Can Spacelift backend be configured to generate/use IAM auth tokens for their connections rather than a password?