tacticmedia / rds-auth-bundle

1.1.2 2026-08-18 01:34 UTC

Requires

• php: >=8.3
• doctrine/doctrine-bundle: ^2.13 || ^3.0
• symfony/config: ^6.4 || ^7.4 || ^8.0
• symfony/dependency-injection: ^6.4 || ^7.4 || ^8.0
• symfony/http-kernel: ^6.4 || ^7.4 || ^8.0
• tacticmedia/rds-auth-middleware: ^1.1

Requires (Dev)

• ext-pdo_sqlite: *
• async-aws/async-aws-bundle: ^1.17
• ergebnis/composer-normalize: ^2.52
• friendsofphp/php-cs-fixer: ^3.95.11
• phpstan/phpstan: ^2.1.0
• phpstan/phpstan-doctrine: ^2.0.27
• phpstan/phpstan-symfony: ^2.0.20
• phpunit/phpunit: ^12.5 || ^13.3
• rector/rector: ^2.5.2
• roave/security-advisories: dev-latest
• symfony/framework-bundle: ^6.4 || ^7.4 || ^8.0

Suggests

• async-aws/async-aws-bundle: Its async_aws.config.region serves as the region fallback when AWS_REGION is not set

MIT

• dbal
• symfony
• doctrine
• aws
• iam
• rds
• secrets-manager

Published on Packagist.org on 2026-08-18 01:34 UTC

README

TL;DR: A bundle you would install in your RDS-powered Symfony application to add seamless support for IAM authentication or managed, automatically rotated password to improve your baseline security posture.

A Symfony bundle that registers and configures tacticmedia/rds-auth-middleware, which selects the database credential for an Amazon RDS instance at connect time using the following logic:

• If iam_username is set: connect as that user with an RDS IAM authentication token as the password.
• If secret_arn is set: connect with the configured password; when the database rejects it, re-read the current password from Secrets Manager, retry once, and dispatch a ConfiguredPasswordOutdated event so the application can alert or redeploy.
• Neither set: the connection parameters stay unchanged.

Every option defaults to an environment variable, so one application image runs unchanged in every environment, with either authentication mode or none.

Installation

composer require tacticmedia/rds-auth-bundle

See Installation for bundle registration.

Documentation

• Installation - requirements, Composer setup, bundle registration
• Configuration - option reference, environment-variable defaults, examples for each mode
• The credential cache - cache pool behavior, APCu setup, token lifetime
• The ConfiguredPasswordOutdated event - firing conditions, payload, listener registration
• The Doctrine DBAL configuration - what the middleware changes at connect time
• Bundle internals - services, middleware registration, package boundary
• Development and testing - commands, kernel test pattern, CI

Contributions

Non-LLM-slop contributions and issues are most definitely welcome.

License

MIT. See LICENSE.

One more thing

This package is brought to you by Tactic Media, a South Australian software development business.

We love to help businesses become more efficient by automating tasks that shouldn't have been done by a human in the first place.

Head over to our website to check out what we do, and if you think we can help you give your employees more time to spend on something more creative, let's talk