[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-rds-db2":3,"mdc-mnuqn9-key":35,"related-repo-aws-rds-db2":2911,"related-org-aws-rds-db2":3017},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"rds-db2","operate Amazon RDS for Db2","Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400) or z\u002FOS mainframe (ADB2GEN, Q Replication), choosing code page\u002Fcollation (EBCDIC, CCSID), S3 backup\u002Frestore, Multi-AZ and cross-region standby replicas, RDSADMIN procedures, customer-managed KMS BYOK, self-managed Active Directory Kerberos, Db2 audit to S3, minimum IAM, or colocation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Database","database","tag",{"name":17,"slug":18,"type":15},"Migration","migration",{"name":20,"slug":21,"type":15},"SQL","sql",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-12T08:42:57.734342",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fdatabase-skills\u002Frds-db2","---\nname: rds-db2\nversion: 2\ndescription: Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400) or z\u002FOS mainframe (ADB2GEN, Q Replication), choosing code page\u002Fcollation (EBCDIC, CCSID), S3 backup\u002Frestore, Multi-AZ and cross-region standby replicas, RDSADMIN procedures, customer-managed KMS BYOK, self-managed Active Directory Kerberos, Db2 audit to S3, minimum IAM, or colocation.\n---\n# Amazon RDS for Db2\n\n## Overview\n\nAmazon RDS for Db2 is a managed IBM Db2 LUW service. RDS for Db2 is managed — you cannot SSH to the host, install agents, or run unfenced external stored procedures in C\u002FCOBOL. Java stored procedures work via `sqlj.install_jar`. This skill covers the operator lifecycle: provisioning with IBM licensing, client install and TLS connectivity, migration from self-managed Db2 on Linux\u002FAIX\u002FWindows\u002Fz\u002FOS\u002FAS400, S3 backup and restore, Multi-AZ and cross-region standby replicas, and RDSADMIN stored procedures that replace SYSCTRL\u002FSYSMAINT authority.\n\nIt also covers six additional security and operations areas: customer-managed KMS keys (BYOK), self-managed Active Directory with Kerberos authentication, Db2 audit to S3, code page and collation selection (EBCDIC, CCSID), minimum IAM permissions, and EC2\u002FRDS colocation for Multi-AZ latency and failover.\n\nThe AWS MCP server is recommended but not required; all operations are expressed in AWS CLI syntax and run with or without it.\n\nRoutes to the matching sub-skill reference. Load only the matching reference.\n\n## Common Tasks\n\n### Verify Dependencies\n\nBefore executing an RDS for Db2 workflow, confirm required tools exist. Do not run installers or API calls yet.\n\n- AWS CLI v2 for every RDS API call\n- AWS credentials via managed mechanism (IAM role, instance profile, `ada credentials update`) — not pasted credentials\n- Client install: `bash`\u002F`curl` access, run as root and as `db2inst1`\n- Airgap install: internet-connected machine + target with VPC endpoints for S3, SSM, Secrets Manager\n- Mainframe migration: z\u002FOS access, IBM ADB2GEN license, Python 3\n- BYOK \u002F customer-managed KMS: `openssl` (to wrap imported key material) and `jq` (to parse `get-parameters-for-import` output)\n- Self-managed Active Directory + Kerberos: `realmd`, `sssd`, `adcli`, `krb5-workstation` on the client, plus a valid Kerberos ticket (`kinit` produces a TGT — check with `klist`)\n- Kerberos JDBC test: a JDK and the Db2 JDBC driver `db2jcc4.jar` v4.33+ (earlier driver versions lack `securityMechanism=11` Kerberos support)\n\n**Constraints:**\n\n- The agent MUST check dependencies before running any install or AWS API command.\n- The agent MUST NOT prompt the user to paste credentials because credentials MUST flow through an IAM role or instance profile.\n- The agent MUST tell the user which dependencies are missing and MUST respect the user's decision to abort.\n- The agent MUST explain, for each step, what it does, why, and which tool will be invoked — before invoking it.\n\n### Classify and Route\n\nMap the user's question to the correct sub-skill reference, then load only that file.\n\n| User says | Sub-skill | Load |\n|---|---|---|\n| create \u002F provision \u002F parameter group \u002F IBM customer ID \u002F IBM site ID \u002F License Manager \u002F BYOL \u002F GovCloud | provisioning | [provisioning.md](references\u002Fprovisioning.md) |\n| connect \u002F SQL30082N \u002F SQL1531N \u002F DSN \u002F CLP \u002F Python \u002F Java \u002F CloudShell \u002F airgap | connectivity | [connectivity.md](references\u002Fconnectivity.md) |\n| SSL \u002F TLS \u002F GSKit \u002F certificate \u002F truststore \u002F bundle.pem | connectivity-tls | [connectivity-tls.md](references\u002Fconnectivity-tls.md) |\n| Python driver \u002F JDBC \u002F laptop \u002F multi-instance \u002F db2_use | connection drivers | [connection-drivers.md](references\u002Fconnection-drivers.md) |\n| migrate \u002F DMS \u002F Q Replication \u002F IIDR \u002F AIX \u002F Windows \u002F AS400 \u002F precheck | migration | [migration.md](references\u002Fmigration.md) |\n| z\u002FOS \u002F mainframe \u002F ADB2GEN \u002F schema conversion | mainframe-migration | [mainframe-migration.md](references\u002Fmainframe-migration.md) |\n| code page \u002F collation \u002F CCSID \u002F EBCDIC \u002F UTF-8 \u002F CODEUNITS32 \u002F territory | code page & collation | [code-page-collation.md](references\u002Fcode-page-collation.md) |\n| snapshot \u002F backup \u002F restore \u002F rollforward \u002F PiTR \u002F S3 integration | backup-restore | [backup-restore.md](references\u002Fbackup-restore.md) |\n| Multi-AZ \u002F standby replica \u002F read replica \u002F HADR \u002F cross-region \u002F failover | ha-dr | [ha-dr.md](references\u002Fha-dr.md) |\n| parameter group \u002F RDSADMIN \u002F scale \u002F storage \u002F CloudWatch \u002F registry variable | operations | [operations.md](references\u002Foperations.md) |\n| BYOK \u002F customer-managed KMS \u002F bring your own key \u002F imported key material \u002F multi-region key | byok | [byok-kms.md](references\u002Fbyok-kms.md) |\n| Active Directory \u002F Kerberos \u002F domain join \u002F self-managed AD \u002F kinit \u002F SPN \u002F realm | ad-kerberos | [ad-kerberos.md](references\u002Fad-kerberos.md) |\n| audit \u002F DB2_AUDIT \u002F audit policy \u002F audit to S3 \u002F option group | db2-audit | [db2-audit.md](references\u002Fdb2-audit.md) |\n| minimum IAM \u002F least privilege \u002F IAM policy \u002F trust policy \u002F permissions | minimum-iam | [minimum-iam.md](references\u002Fminimum-iam.md) |\n| colocation \u002F co-locate \u002F EC2 app latency \u002F ASG \u002F ALB \u002F failover routing | colocation | [colocation.md](references\u002Fcolocation.md) |\n\n**Constraints:**\n\n- The agent MUST read only the reference files that match the user's question, to keep the context focused.\n- The agent MUST NOT invent RDSADMIN procedure signatures, because wrong parameter order will fail at runtime — always cite the signature from the reference file.\n- The agent MUST cite the source blog URL when an answer is blog-sourced, so the user can verify specifics.\n- If a question crosses two sub-skills (e.g. \"migrate z\u002FOS with near-zero downtime\", or \"BYOK plus cross-region standby\"), the agent SHOULD load each matching reference and combine them.\n\n### Execute Workflow\n\nOnce routed, give the user a concrete, runnable answer grounded in the reference file.\n\nParameter acquisition:\n\n- All required parameters (region, instance identifier, source\u002Ftarget ARNs, S3 bucket, prefix, the `--master-username` value) MUST be collected upfront in a single message.\n- Parameter formats MUST be specified: region `us-east-1`-style; instance identifier `^[a-zA-Z][a-zA-Z0-9-]{0,62}$`; ARN `arn:aws:rds:\u003Cregion>:\u003Caccount>:db:\u003Cname>`; S3 bucket 3–63 chars lowercase.\n- The agent MUST accept parameters via direct input, a JSON\u002FYAML file path, or a URL.\n\nTool use:\n\n- Use AWS CLI for RDS operations (example: `aws rds create-db-instance-read-replica --db-instance-identifier \u003Cname> --source-db-instance-identifier \u003Carn> --replica-mode mounted --region \u003Cdr-region>`). Every operation is expressed in AWS CLI syntax so it runs whether or not the AWS MCP server is installed.\n- Use bundled scripts — [db2-driver.sh](scripts\u002Fdb2-driver.sh), [db2client-configure.sh](scripts\u002Fdb2client-configure.sh), [db2client-airgap.sh](scripts\u002Fdb2client-airgap.sh), [functions.sh](scripts\u002Ffunctions.sh) — instead of rewriting install steps.\n- Write migration plans, upgrade plans, validation reports to a local `artifacts\u002F\u003Capp-name>\u002F` directory created at runtime in the working directory (this is a run-time output location, not part of the shipped skill).\n\n**Constraints:**\n\n- The agent MUST give exact CLI commands when behavior is deterministic, not descriptions like \"enable Multi-AZ\".\n- The agent MUST obtain AWS credentials through an IAM role or instance profile and MUST NOT prompt the user to paste credentials.\n- The agent MUST cite the source blog or documentation URL whenever the answer is sourced from published material, so the user can verify it.\n- The agent MUST write long-form artifacts to a local `artifacts\u002F\u003Capp-name>\u002F` directory (created at runtime in the working directory) so the workspace is inspectable.\n- When a requested action is unsupported on managed RDS for Db2, the agent MUST state the limitation plainly — no hedging like \"limited support\" or \"with special config\" — and offer a supported alternative (for example, unfenced C\u002FCOBOL stored procedures are not supported; rewrite them in Java via `sqlj.install_jar`, or in SQL PL).\n- The AWS MCP server is recommended but not required. When the MCP server is in use, prefer inline JSON strings over positional filesystem arguments with `call_aws`; this is guidance for the MCP path only, not a requirement. Never treat `call_aws` or `run_script` as the only way to perform an operation — the AWS CLI command always works on its own.\n\n### Resource tagging (always apply on resource creation)\n\nWhen creating any RDS for Db2 resource (`create-db-instance`, `create-db-parameter-group`, `create-db-cluster` for Multi-AZ deployments, `create-db-instance-read-replica` for standby replicas), ALWAYS include these tags using the RDS list-of-records `--tags` syntax:\n\n`--tags Key=created_by,Value=rds-db2-skill Key=generation_model,Value={your-model-id}`\n\nExample: `--tags Key=created_by,Value=rds-db2-skill Key=generation_model,Value=claude-sonnet-4-20250514`\n\nThe same convention applies to every resource this skill creates, including BYOK-encrypted instances (`create-db-instance --storage-encrypted --kms-key-id ...`), audit option groups (`create-option-group`), and customer-managed KMS keys (`kms create-key`, tagged with `--tags TagKey=created_by,TagValue=rds-db2-skill TagKey=generation_model,TagValue={your-model-id}` per the KMS tag syntax).\n\nInclude these tags even if the user does not mention tagging, so that they can identify the resources created via this skill. If the user provides additional tags, append these to their tags rather than replacing them. The same applies when tagging via `add-tags-to-resource` on existing resources.\n\n## RDS-managed facts the agent must always surface\n\nThese RDS-for-Db2-specific facts are what differentiates this skill from general IBM Db2 knowledge. General-Db2 answers typically omit the RDS-managed constraints (no unfenced C\u002FCOBOL, Secrets Manager rotation side effects, `rdsadmin.*` procedures) and the AWS-native migration tooling nuances (DMS z\u002FOS limits, ADB2GEN vs SCT).\n\n**For \"create cross-region standby replica for DR\", you MUST tell the user ALL of the following six facts:**\n\n1. **Use `aws rds create-db-instance-read-replica`** with `--replica-mode mounted` and the cross-region source ARN — Db2 cross-region standby uses **mounted replica mode**, NOT transactional read-replica mode.\n2. **Source prerequisite: automated backups enabled** on the source instance (backup retention period > 0).\n3. **Target-region prerequisite: custom parameter group** created in the target region before the command runs.\n4. **Target-region prerequisite: KMS key** available in the target region (multi-region KMS key or a target-region customer-managed KMS key).\n5. **State prerequisites: all databases in `active` state, no pending reboots**, no license-model restrictions blocking cross-region replicas.\n6. **Explain the mounted-vs-transactional distinction** — mounted replicas do not accept reads or SQL from applications; they exist purely as a DR standby that can be promoted. Do not suggest read offload use cases.\n\n**For \"restore Db2 backup from S3 (multi-part, N files)\", you MUST tell the user ALL of the following six facts — never omit any of the procedure names:**\n\n1. **Attach IAM role with S3 access via `aws rds add-role-to-db-instance`** using `--feature-name S3_INTEGRATION`.\n2. **Set restore performance parameters via `rdsadmin.set_configuration`** — tune `USE_STREAMING_RESTORE`, `RESTORE_DATABASE_NUM_BUFFERS`, and `PARALLELISM` before starting the restore.\n3. **Call `rdsadmin.restore_database`** with five parameters in this exact order: database name, restore mode (`OFFLINE` or `ONLINE`), S3 prefix, S3 bucket, and region. Multi-file (multi-part) backups are handled by the shared prefix — there is no separate multi-part flag parameter. (Signature: `rdsadmin.restore_database(dbname, type, prefix, bucket, region)`.)\n4. **For `ONLINE` restore mode, follow up with `rdsadmin.rollforward_database`** to replay archive logs, then `rdsadmin.complete_rollforward` to finish. `OFFLINE` restores do NOT need rollforward.\n5. **Monitor progress with `rdsadmin.get_task_status`** — every `rdsadmin` procedure returns a task ID you poll.\n6. **Warn about VPC endpoint for S3 if no internet egress** from the private subnet, and warn about **Db2 version compatibility** between the source backup and the RDS instance engine version (forward-compatible, not backward).\n\n**For \"C\u002FCOBOL unfenced external stored procedures — lift and shift to RDS for Db2?\", you MUST tell the user ALL of the following four facts:**\n\n1. **Unfenced external stored procedures in C and COBOL are NOT supported on RDS for Db2.** State this as an unqualified \"not supported\" — do not hedge with \"limited support\" or \"with special config.\"\n2. **All routines on RDS for Db2 MUST be fenced.** This is a managed-service architectural constraint, not a flag.\n3. **Java stored procedures are supported** — install via `sqlj.install_jar`. C\u002FCOBOL SPs should be **rewritten in Java or SQL PL** (Db2's procedural SQL, equivalent to Oracle's PL\u002FSQL).\n4. **Offer to help identify which SPs are unfenced** and prioritize the rewrite by call frequency (hot code path first).\n\n**For \"migrate Db2 for z\u002FOS to RDS for Db2 with near-zero downtime\", you MUST tell the user ALL of the following five facts:**\n\n1. **For near-zero-downtime from z\u002FOS, use Q Replication (IBM IIDR), Qlik Replicate, or Precisely** — these are the CDC tools that support Db2 for z\u002FOS as a source streaming to RDS for Db2.\n2. **AWS DMS supports FULL LOAD ONLY from Db2 for z\u002FOS.** DMS does NOT support CDC from z\u002FOS sources. Use DMS for a one-time bulk load, not for near-zero-downtime cutover.\n3. **Use ADB2GEN for schema conversion from z\u002FOS.** AWS SCT does NOT support Db2 for z\u002FOS as a source — this is a common trap. Do not recommend SCT for z\u002FOS sources.\n4. **Code-page conversion (EBCDIC → UTF-8) is the primary migration risk.** Plan explicit collation and code page mapping before cutover — silent data corruption is the failure mode.\n5. **Plan explicit collation selection** on the target RDS instance to match the semantic ordering of the z\u002FOS source.\n\n**For \"SQL30082N — USERNAME AND\u002FOR PASSWORD INVALID\" with RDS-managed master user (user didn't change it), you MUST tell the user ALL of the following four facts:**\n\n1. **SQL30082N after a previously-working connection almost always means the master password rotated in Secrets Manager.** RDS for Db2 rotates the master password on the Secrets Manager schedule — clients using a cached password will start failing with SQL30082N even though nothing on their side changed.\n2. **Fix: run `db2_use \u003Cinstance-id>`** (from `functions.sh` \u002F the bundled helpers). This fetches the current password from Secrets Manager and rewrites `~\u002F.db2env` with the new value.\n3. **Alternative: `db2_test_connection`** to verify the helper's fix worked end-to-end.\n4. **If `db2_use` isn't installed**, the user needs to pull the current password with `aws secretsmanager get-secret-value` and update their local credential cache manually. Do not tell them to rotate the password — the password rotation is what caused the problem.\n\n**For \"BYOK \u002F customer-managed KMS key for RDS for Db2\", you MUST tell the user ALL of the following six facts:**\n\n1. **Use a multi-region KMS key with `--origin EXTERNAL`** when importing your own key material, so the same key ID and material can replicate to a DR region.\n2. **The creating principal needs `kms:CreateGrant` and `kms:DescribeKey`** on the key, or instance creation fails.\n3. **Encryption is set at instance creation** with `--storage-encrypted --kms-key-id \u003Calias|arn>`. You **cannot encrypt an existing unencrypted instance in place** — go snapshot → `copy-db-snapshot --kms-key-id` → `restore-db-instance-from-db-snapshot`.\n4. **For cross-region DR, replicate the multi-region key (`kms:ReplicateKey`)** into the DR region first, then `copy-db-snapshot` across regions with the replica key.\n5. **Import tokens expire after 24 hours** — if `import-key-material` fails on expiry, re-run `get-parameters-for-import` to get a fresh token and wrapping key.\n6. **Cite blog DBBLOG-5188 and [byok-kms.md](references\u002Fbyok-kms.md)**; do not invent KMS parameter names.\n\n**For \"self-managed Active Directory with Kerberos on RDS for Db2\", you MUST tell the user ALL of the following six facts:**\n\n1. **RDS joins your AD via `--domain-fqdn`, `--domain-ou`, `--domain-auth-secret-arn`, and `--domain-dns-ips`** — the self-managed AD path, with no AWS Managed Microsoft AD required.\n2. **The Secrets Manager secret uses keys `SELF_MANAGED_ACTIVE_DIRECTORY_USERNAME`** (the sAMAccountName only — **no `DOMAIN\\` prefix**, which fails creation) **and `SELF_MANAGED_ACTIVE_DIRECTORY_PASSWORD`**, encrypted by a dedicated KMS key, with a resource policy trusting `rds.amazonaws.com` guarded by `aws:SourceArn` and `aws:SourceAccount` (confused-deputy protection).\n3. **Delegate the nine AD permissions** to a dedicated service account scoped to one OU; grant `servicePrincipalName` read\u002Fwrite on **User** objects using **ADSI Edit**, not the ADUC delegation wizard (which filters that attribute out) — this is the most common failure.\n4. **Open AD ports between RDS and the domain controllers: DNS 53, Kerberos 88 and 464, LDAP 389 and 3268, and the RPC range 49152–65535.** Missing the RPC range is the top cause of intermittent join failures. Keep clock skew under 5 minutes.\n5. **The RDS master user is a local account that cannot get a Kerberos ticket.** AD users need `kinit` plus a `GRANT CONNECT`. Kerberos JDBC uses `securityMechanism=11` and a **region-specific PEM** via `sslCertLocation` (never `global-bundle.pem`).\n6. **Cite the self-managed AD blog and [ad-kerberos.md](references\u002Fad-kerberos.md)**; verify with `describe-db-instances ... DomainMemberships` showing `Status: joined`.\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|---|---|---|\n| `SQL30082N` | Password rotated in Secrets Manager | Run `db2_use \u003Cinstance-id>` — the helper re-fetches the current password and rewrites `~\u002F.db2env`. |\n| `SQL1531N` | DSN not yet in cache | `db2 terminate` to clear, then retry; if still failing, re-run [db2client-configure.sh](scripts\u002Fdb2client-configure.sh). |\n| `SQL01013N` \u002F TCP timeout | Security group blocks 50000\u002F50443 | Check SG inbound rules — add client's SG on TCP 50000 (plain) or 50443 (SSL). |\n| GSKit \u002F SSL certificate error | RDS cert bundle missing or RSA cert not first | Re-download `\u003Cregion>-bundle.pem` from RDS truststore and re-run `db2client-configure.sh`. |\n| Access denied on RDSADMIN call | IAM role missing `S3_INTEGRATION` feature | `aws rds add-role-to-db-instance --feature-name S3_INTEGRATION --role-arn \u003Crole-arn> --db-instance-identifier \u003Cid>`. |\n| Restore fails with \"database in rollforward pending\" | ONLINE restore left DB in rollforward state | Call `rdsadmin.rollforward_database` for each archive log, then `rdsadmin.complete_rollforward`. |\n| Standby replica creation fails | Missing prereqs | Verify: automated backups enabled, custom parameter group in DR region, KMS multi-region key, no pending `rdsadmin` tasks, all databases in active state. |\n| AD domain join `Status` not `joined` | RPC port range blocked, wrong secret format, or SPN attribute missing | Open RPC 49152–65535 between RDS and the DCs, confirm the secret username is the sAMAccountName with no `DOMAIN\\` prefix, and grant `servicePrincipalName` on User objects via ADSI Edit — see [ad-kerberos.md](references\u002Fad-kerberos.md). |\n| `import-key-material` fails — token expired | Import token older than 24 hours | Re-run `get-parameters-for-import` for a fresh token and wrapping key, re-wrap the material with `openssl`, then retry the import — see [byok-kms.md](references\u002Fbyok-kms.md). |\n| Throttling from RDS API | Exceeded API request rate | Exponential backoff with jitter; batch operations; check Service Quotas. |\n\n## Security Considerations\n\nSurface these controls when advising on any production RDS for Db2 deployment. They consolidate the security guidance that the sub-skill references cover in depth.\n\n- **Encryption at rest and in transit** — Always create instances with `--storage-encrypted`; for key ownership and compliance use a customer-managed KMS key (BYOK), and for DR use a multi-region key. Enforce TLS on every connection (port 50443, `\u003Cregion>-bundle.pem`); never connect in plaintext for production. See [byok-kms.md](references\u002Fbyok-kms.md) and [connectivity-tls.md](references\u002Fconnectivity-tls.md). (Guideline 1)\n- **Least-privilege IAM** — Use the scoped policy and trust policy in [minimum-iam.md](references\u002Fminimum-iam.md); never attach a `*FullAccess` managed policy. Scope `iam:PassRole` and ARN-pattern every mutating statement that supports resource-level permissions. (Guideline 5)\n- **Network isolation** — Keep instances in private subnets, restrict security groups to the application\u002Fsource SG (never `0.0.0.0\u002F0`), and use VPC endpoints for S3\u002FSSM\u002FSecrets Manager so traffic stays off the public internet. See [colocation.md](references\u002Fcolocation.md). (Guideline 5)\n- **Audit logging and monitoring** — Enable Db2 audit to S3 ([db2-audit.md](references\u002Fdb2-audit.md)), RDS Enhanced Monitoring, and CloudTrail for RDS\u002FKMS\u002FSecrets Manager API calls. Alarm on failed logins and configuration changes. (Guideline 12)\n- **Secret rotation** — Provision with `--manage-master-user-password` so RDS stores and rotates the master password in Secrets Manager; never embed plaintext passwords. After rotation, refresh clients with `db2_use \u003Cinstance-id>`. (Guideline 13)\n- **Backup encryption and retention** — Set a backup retention period, encrypt automated and manual snapshots with your KMS key, and apply S3 bucket encryption plus lifecycle\u002Fretention to any Db2 audit or backup buckets. (Guideline 13)\n\n## Additional Resources\n\n### In-scope documentation and blogs\n\n- AWS docs — RDS for Db2: https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FCHAP_RDSDb2.html\n- AWS docs — RDS for Db2 IAM permissions: https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FUsingWithRDS.IAM.html\n- AWS docs — Kerberos authentication for RDS for Db2: https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002Fdb2-kerberos.html\n- Blog — Connect to RDS for Db2 from CloudShell: https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fconnect-to-amazon-rds-for-db2-using-aws-cloudshell\u002F\n- Blog — Restore self-managed Db2 Linux into RDS for Db2: https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Frestore-self-managed-db2-linux-databases-in-amazon-rds-for-db2\u002F\n- Blog — Near-zero downtime from AIX\u002FWindows to RDS for Db2 with Q Replication: https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fnear-zero-downtime-migrations-from-self-managed-db2-on-aix-or-windows-to-amazon-rds-for-db2-using-ibm-q-replication\u002F\n- Blog — Cross-region standby replicas: https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fconfigure-amazon-rds-for-db2-standby-replicas-for-high-availability-and-faster-disaster-recovery\u002F\n- Blog — Mainframe DDL conversion (z\u002FOS to RDS for Db2): https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fmigrating-tables-from-ibm-db2-for-z-os-to-amazon-rds-for-db2\u002F\n- Blog — Code page and collation for mainframe migration: https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fchoosing-the-right-code-page-and-collation-for-migration-from-mainframe-db2-to-amazon-rds-for-db2\u002F\n- Blog — Bring your own customer-managed KMS key for RDS for Db2 (DBBLOG-5188): https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fbring-your-own-key-to-amazon-rds-for-db2-with-a-customer-managed-kms-key\u002F\n- Blog — Self-managed Active Directory with Kerberos for RDS for Db2: https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fuse-kerberos-authentication-with-a-self-managed-active-directory-for-amazon-rds-for-db2\u002F\n\n### Related topics (cited resources, not yet routed sub-skills)\n\nThese adjacent topics are not expanded into routed references in this iteration. Each is discoverable through the cited resource below.\n\n- Reverse log shipping for RDS for Db2 (DBBLOG-5352): https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fimplement-reverse-log-shipping-for-amazon-rds-for-db2\u002F\n- Multi-account connectivity: workspace source `04-db2-client\u002FRDS-Db2-Multiple-Account-Connectivity\u002F`\n- Terraform provisioning: workspace source `04-db2-client\u002FRDS-Db2-Terraform\u002F`\n- CIS compliance: workspace source `04-db2-client\u002FCIS-Compliance\u002F`\n- db2mon monitoring: workspace source `04-db2-client\u002Fdb2mon_RDS\u002F`\n- Compression savings: workspace source `04-db2-client\u002FCompression-Savings\u002F`\n- Migration prerequisite check (DBBLOG-5048): https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fmigrate-from-ibm-db2-to-amazon-rds-for-db2-using-a-migration-prerequisite-check\u002F\n- Load from S3: workspace source `04-db2-client\u002Fload-from-s3\u002F`\n- Sample Java stored procedures: workspace source `04-db2-client\u002Fsample-java-sp\u002F`\n\n### Blog catalog\n\nThe authoritative list of published RDS for Db2 blogs and sample tools is maintained at https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fsample-rds-db2-tools\u002Ftree\u002Fmain — consult it for the current set of blog articles and companion code.\n\n- Related skill (migrating off Db2 LUW to PostgreSQL): `rds-postgres-migration` (if present in corpus).\n\n## Handoff from aws-database-selection\n\nThis skill can be invoked directly, or it can be entered from the `aws-database-selection` parent skill after that skill has run a requirements interview and produced a `requirements.json` artifact. When you see a backtick-wrapped path matching `aws_dbs_requirements\u002F*\u002Frequirements.json` in recent conversation, follow the entry protocol in `aws-database-selection\u002Freferences\u002Fhandoff-contract.md`:\n\n1. Read the artifact using `file_read`.\n2. Validate it against `aws-database-selection\u002Freferences\u002Fworkload-primary-artifact.schema.json`. If malformed or unreadable, tell the user and proceed without it.\n3. Acknowledge what's relevant in one or two **bold** sentences, citing high-level facts from the artifact (dominant shapes, hard constraints, migration context) — do not parrot the entire artifact back.\n4. Scope-check: this skill is scoped to Amazon RDS for Db2 — migrations from Db2 z\u002FOS or LUW, HADR, standby replicas, SQL PL routines, Q Replication cutovers. If the artifact's `workload_primaries.dominant_shapes` or `migration_context` don't match that scope, emit weak backpressure per the handoff contract: suggest `amazon-aurora` for refactor-to-PostgreSQL from Db2, or go back to `aws-database-selection` if Db2 isn't the source, then ask the user whether to go back or proceed anyway. Do not silently misuse the artifact.\n5. Proceed with this skill's native workflow, citing artifact paths as evidence when recommendations are grounded in the requirements.\n\nThe curated RDS-for-Db2 selection facts that the parent `aws-database-selection` skill consumes live at `assets\u002Fselection-knowledge-input.json` (with a human-readable companion at `assets\u002Fselection-knowledge-input.md`). These capture the in-scope source-migration scenarios, hard constraints, HA\u002FDR options, and security areas in a structured, reusable form — read them when you need the curated selection view rather than re-deriving it.\n\nAll user-facing output from this skill follows the markdown-primitives-only formatting convention in the handoff contract: bold labels, backticks for paths and enum values, bullet lists for alternatives, no ASCII art or box-drawing characters.\n",{"data":36,"body":38},{"name":4,"version":37,"description":6},2,{"type":39,"children":40},"root",[41,50,57,72,77,82,87,93,100,105,266,275,298,304,309,672,679,702,708,713,718,768,773,836,843,913,919,962,971,982,1019,1032,1038,1051,1059,1152,1160,1344,1352,1409,1417,1470,1478,1564,1572,1718,1726,1959,1965,2313,2319,2324,2470,2476,2482,2607,2613,2618,2720,2726,2739,2755,2761,2798,2878,2906],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"amazon-rds-for-db2",[47],{"type":48,"value":49},"text","Amazon RDS for Db2",{"type":42,"tag":51,"props":52,"children":54},"h2",{"id":53},"overview",[55],{"type":48,"value":56},"Overview",{"type":42,"tag":58,"props":59,"children":60},"p",{},[61,63,70],{"type":48,"value":62},"Amazon RDS for Db2 is a managed IBM Db2 LUW service. RDS for Db2 is managed — you cannot SSH to the host, install agents, or run unfenced external stored procedures in C\u002FCOBOL. Java stored procedures work via ",{"type":42,"tag":64,"props":65,"children":67},"code",{"className":66},[],[68],{"type":48,"value":69},"sqlj.install_jar",{"type":48,"value":71},". This skill covers the operator lifecycle: provisioning with IBM licensing, client install and TLS connectivity, migration from self-managed Db2 on Linux\u002FAIX\u002FWindows\u002Fz\u002FOS\u002FAS400, S3 backup and restore, Multi-AZ and cross-region standby replicas, and RDSADMIN stored procedures that replace SYSCTRL\u002FSYSMAINT authority.",{"type":42,"tag":58,"props":73,"children":74},{},[75],{"type":48,"value":76},"It also covers six additional security and operations areas: customer-managed KMS keys (BYOK), self-managed Active Directory with Kerberos authentication, Db2 audit to S3, code page and collation selection (EBCDIC, CCSID), minimum IAM permissions, and EC2\u002FRDS colocation for Multi-AZ latency and failover.",{"type":42,"tag":58,"props":78,"children":79},{},[80],{"type":48,"value":81},"The AWS MCP server is recommended but not required; all operations are expressed in AWS CLI syntax and run with or without it.",{"type":42,"tag":58,"props":83,"children":84},{},[85],{"type":48,"value":86},"Routes to the matching sub-skill reference. Load only the matching reference.",{"type":42,"tag":51,"props":88,"children":90},{"id":89},"common-tasks",[91],{"type":48,"value":92},"Common Tasks",{"type":42,"tag":94,"props":95,"children":97},"h3",{"id":96},"verify-dependencies",[98],{"type":48,"value":99},"Verify Dependencies",{"type":42,"tag":58,"props":101,"children":102},{},[103],{"type":48,"value":104},"Before executing an RDS for Db2 workflow, confirm required tools exist. Do not run installers or API calls yet.",{"type":42,"tag":106,"props":107,"children":108},"ul",{},[109,115,128,155,160,165,194,245],{"type":42,"tag":110,"props":111,"children":112},"li",{},[113],{"type":48,"value":114},"AWS CLI v2 for every RDS API call",{"type":42,"tag":110,"props":116,"children":117},{},[118,120,126],{"type":48,"value":119},"AWS credentials via managed mechanism (IAM role, instance profile, ",{"type":42,"tag":64,"props":121,"children":123},{"className":122},[],[124],{"type":48,"value":125},"ada credentials update",{"type":48,"value":127},") — not pasted credentials",{"type":42,"tag":110,"props":129,"children":130},{},[131,133,139,141,147,149],{"type":48,"value":132},"Client install: ",{"type":42,"tag":64,"props":134,"children":136},{"className":135},[],[137],{"type":48,"value":138},"bash",{"type":48,"value":140},"\u002F",{"type":42,"tag":64,"props":142,"children":144},{"className":143},[],[145],{"type":48,"value":146},"curl",{"type":48,"value":148}," access, run as root and as ",{"type":42,"tag":64,"props":150,"children":152},{"className":151},[],[153],{"type":48,"value":154},"db2inst1",{"type":42,"tag":110,"props":156,"children":157},{},[158],{"type":48,"value":159},"Airgap install: internet-connected machine + target with VPC endpoints for S3, SSM, Secrets Manager",{"type":42,"tag":110,"props":161,"children":162},{},[163],{"type":48,"value":164},"Mainframe migration: z\u002FOS access, IBM ADB2GEN license, Python 3",{"type":42,"tag":110,"props":166,"children":167},{},[168,170,176,178,184,186,192],{"type":48,"value":169},"BYOK \u002F customer-managed KMS: ",{"type":42,"tag":64,"props":171,"children":173},{"className":172},[],[174],{"type":48,"value":175},"openssl",{"type":48,"value":177}," (to wrap imported key material) and ",{"type":42,"tag":64,"props":179,"children":181},{"className":180},[],[182],{"type":48,"value":183},"jq",{"type":48,"value":185}," (to parse ",{"type":42,"tag":64,"props":187,"children":189},{"className":188},[],[190],{"type":48,"value":191},"get-parameters-for-import",{"type":48,"value":193}," output)",{"type":42,"tag":110,"props":195,"children":196},{},[197,199,205,207,213,214,220,221,227,229,235,237,243],{"type":48,"value":198},"Self-managed Active Directory + Kerberos: ",{"type":42,"tag":64,"props":200,"children":202},{"className":201},[],[203],{"type":48,"value":204},"realmd",{"type":48,"value":206},", ",{"type":42,"tag":64,"props":208,"children":210},{"className":209},[],[211],{"type":48,"value":212},"sssd",{"type":48,"value":206},{"type":42,"tag":64,"props":215,"children":217},{"className":216},[],[218],{"type":48,"value":219},"adcli",{"type":48,"value":206},{"type":42,"tag":64,"props":222,"children":224},{"className":223},[],[225],{"type":48,"value":226},"krb5-workstation",{"type":48,"value":228}," on the client, plus a valid Kerberos ticket (",{"type":42,"tag":64,"props":230,"children":232},{"className":231},[],[233],{"type":48,"value":234},"kinit",{"type":48,"value":236}," produces a TGT — check with ",{"type":42,"tag":64,"props":238,"children":240},{"className":239},[],[241],{"type":48,"value":242},"klist",{"type":48,"value":244},")",{"type":42,"tag":110,"props":246,"children":247},{},[248,250,256,258,264],{"type":48,"value":249},"Kerberos JDBC test: a JDK and the Db2 JDBC driver ",{"type":42,"tag":64,"props":251,"children":253},{"className":252},[],[254],{"type":48,"value":255},"db2jcc4.jar",{"type":48,"value":257}," v4.33+ (earlier driver versions lack ",{"type":42,"tag":64,"props":259,"children":261},{"className":260},[],[262],{"type":48,"value":263},"securityMechanism=11",{"type":48,"value":265}," Kerberos support)",{"type":42,"tag":58,"props":267,"children":268},{},[269],{"type":42,"tag":270,"props":271,"children":272},"strong",{},[273],{"type":48,"value":274},"Constraints:",{"type":42,"tag":106,"props":276,"children":277},{},[278,283,288,293],{"type":42,"tag":110,"props":279,"children":280},{},[281],{"type":48,"value":282},"The agent MUST check dependencies before running any install or AWS API command.",{"type":42,"tag":110,"props":284,"children":285},{},[286],{"type":48,"value":287},"The agent MUST NOT prompt the user to paste credentials because credentials MUST flow through an IAM role or instance profile.",{"type":42,"tag":110,"props":289,"children":290},{},[291],{"type":48,"value":292},"The agent MUST tell the user which dependencies are missing and MUST respect the user's decision to abort.",{"type":42,"tag":110,"props":294,"children":295},{},[296],{"type":48,"value":297},"The agent MUST explain, for each step, what it does, why, and which tool will be invoked — before invoking it.",{"type":42,"tag":94,"props":299,"children":301},{"id":300},"classify-and-route",[302],{"type":48,"value":303},"Classify and Route",{"type":42,"tag":58,"props":305,"children":306},{},[307],{"type":48,"value":308},"Map the user's question to the correct sub-skill reference, then load only that file.",{"type":42,"tag":310,"props":311,"children":312},"table",{},[313,337],{"type":42,"tag":314,"props":315,"children":316},"thead",{},[317],{"type":42,"tag":318,"props":319,"children":320},"tr",{},[321,327,332],{"type":42,"tag":322,"props":323,"children":324},"th",{},[325],{"type":48,"value":326},"User says",{"type":42,"tag":322,"props":328,"children":329},{},[330],{"type":48,"value":331},"Sub-skill",{"type":42,"tag":322,"props":333,"children":334},{},[335],{"type":48,"value":336},"Load",{"type":42,"tag":338,"props":339,"children":340},"tbody",{},[341,365,387,409,431,452,474,496,518,540,562,584,606,628,650],{"type":42,"tag":318,"props":342,"children":343},{},[344,350,355],{"type":42,"tag":345,"props":346,"children":347},"td",{},[348],{"type":48,"value":349},"create \u002F provision \u002F parameter group \u002F IBM customer ID \u002F IBM site ID \u002F License Manager \u002F BYOL \u002F GovCloud",{"type":42,"tag":345,"props":351,"children":352},{},[353],{"type":48,"value":354},"provisioning",{"type":42,"tag":345,"props":356,"children":357},{},[358],{"type":42,"tag":359,"props":360,"children":362},"a",{"href":361},"references\u002Fprovisioning.md",[363],{"type":48,"value":364},"provisioning.md",{"type":42,"tag":318,"props":366,"children":367},{},[368,373,378],{"type":42,"tag":345,"props":369,"children":370},{},[371],{"type":48,"value":372},"connect \u002F SQL30082N \u002F SQL1531N \u002F DSN \u002F CLP \u002F Python \u002F Java \u002F CloudShell \u002F airgap",{"type":42,"tag":345,"props":374,"children":375},{},[376],{"type":48,"value":377},"connectivity",{"type":42,"tag":345,"props":379,"children":380},{},[381],{"type":42,"tag":359,"props":382,"children":384},{"href":383},"references\u002Fconnectivity.md",[385],{"type":48,"value":386},"connectivity.md",{"type":42,"tag":318,"props":388,"children":389},{},[390,395,400],{"type":42,"tag":345,"props":391,"children":392},{},[393],{"type":48,"value":394},"SSL \u002F TLS \u002F GSKit \u002F certificate \u002F truststore \u002F bundle.pem",{"type":42,"tag":345,"props":396,"children":397},{},[398],{"type":48,"value":399},"connectivity-tls",{"type":42,"tag":345,"props":401,"children":402},{},[403],{"type":42,"tag":359,"props":404,"children":406},{"href":405},"references\u002Fconnectivity-tls.md",[407],{"type":48,"value":408},"connectivity-tls.md",{"type":42,"tag":318,"props":410,"children":411},{},[412,417,422],{"type":42,"tag":345,"props":413,"children":414},{},[415],{"type":48,"value":416},"Python driver \u002F JDBC \u002F laptop \u002F multi-instance \u002F db2_use",{"type":42,"tag":345,"props":418,"children":419},{},[420],{"type":48,"value":421},"connection drivers",{"type":42,"tag":345,"props":423,"children":424},{},[425],{"type":42,"tag":359,"props":426,"children":428},{"href":427},"references\u002Fconnection-drivers.md",[429],{"type":48,"value":430},"connection-drivers.md",{"type":42,"tag":318,"props":432,"children":433},{},[434,439,443],{"type":42,"tag":345,"props":435,"children":436},{},[437],{"type":48,"value":438},"migrate \u002F DMS \u002F Q Replication \u002F IIDR \u002F AIX \u002F Windows \u002F AS400 \u002F precheck",{"type":42,"tag":345,"props":440,"children":441},{},[442],{"type":48,"value":18},{"type":42,"tag":345,"props":444,"children":445},{},[446],{"type":42,"tag":359,"props":447,"children":449},{"href":448},"references\u002Fmigration.md",[450],{"type":48,"value":451},"migration.md",{"type":42,"tag":318,"props":453,"children":454},{},[455,460,465],{"type":42,"tag":345,"props":456,"children":457},{},[458],{"type":48,"value":459},"z\u002FOS \u002F mainframe \u002F ADB2GEN \u002F schema conversion",{"type":42,"tag":345,"props":461,"children":462},{},[463],{"type":48,"value":464},"mainframe-migration",{"type":42,"tag":345,"props":466,"children":467},{},[468],{"type":42,"tag":359,"props":469,"children":471},{"href":470},"references\u002Fmainframe-migration.md",[472],{"type":48,"value":473},"mainframe-migration.md",{"type":42,"tag":318,"props":475,"children":476},{},[477,482,487],{"type":42,"tag":345,"props":478,"children":479},{},[480],{"type":48,"value":481},"code page \u002F collation \u002F CCSID \u002F EBCDIC \u002F UTF-8 \u002F CODEUNITS32 \u002F territory",{"type":42,"tag":345,"props":483,"children":484},{},[485],{"type":48,"value":486},"code page & collation",{"type":42,"tag":345,"props":488,"children":489},{},[490],{"type":42,"tag":359,"props":491,"children":493},{"href":492},"references\u002Fcode-page-collation.md",[494],{"type":48,"value":495},"code-page-collation.md",{"type":42,"tag":318,"props":497,"children":498},{},[499,504,509],{"type":42,"tag":345,"props":500,"children":501},{},[502],{"type":48,"value":503},"snapshot \u002F backup \u002F restore \u002F rollforward \u002F PiTR \u002F S3 integration",{"type":42,"tag":345,"props":505,"children":506},{},[507],{"type":48,"value":508},"backup-restore",{"type":42,"tag":345,"props":510,"children":511},{},[512],{"type":42,"tag":359,"props":513,"children":515},{"href":514},"references\u002Fbackup-restore.md",[516],{"type":48,"value":517},"backup-restore.md",{"type":42,"tag":318,"props":519,"children":520},{},[521,526,531],{"type":42,"tag":345,"props":522,"children":523},{},[524],{"type":48,"value":525},"Multi-AZ \u002F standby replica \u002F read replica \u002F HADR \u002F cross-region \u002F failover",{"type":42,"tag":345,"props":527,"children":528},{},[529],{"type":48,"value":530},"ha-dr",{"type":42,"tag":345,"props":532,"children":533},{},[534],{"type":42,"tag":359,"props":535,"children":537},{"href":536},"references\u002Fha-dr.md",[538],{"type":48,"value":539},"ha-dr.md",{"type":42,"tag":318,"props":541,"children":542},{},[543,548,553],{"type":42,"tag":345,"props":544,"children":545},{},[546],{"type":48,"value":547},"parameter group \u002F RDSADMIN \u002F scale \u002F storage \u002F CloudWatch \u002F registry variable",{"type":42,"tag":345,"props":549,"children":550},{},[551],{"type":48,"value":552},"operations",{"type":42,"tag":345,"props":554,"children":555},{},[556],{"type":42,"tag":359,"props":557,"children":559},{"href":558},"references\u002Foperations.md",[560],{"type":48,"value":561},"operations.md",{"type":42,"tag":318,"props":563,"children":564},{},[565,570,575],{"type":42,"tag":345,"props":566,"children":567},{},[568],{"type":48,"value":569},"BYOK \u002F customer-managed KMS \u002F bring your own key \u002F imported key material \u002F multi-region key",{"type":42,"tag":345,"props":571,"children":572},{},[573],{"type":48,"value":574},"byok",{"type":42,"tag":345,"props":576,"children":577},{},[578],{"type":42,"tag":359,"props":579,"children":581},{"href":580},"references\u002Fbyok-kms.md",[582],{"type":48,"value":583},"byok-kms.md",{"type":42,"tag":318,"props":585,"children":586},{},[587,592,597],{"type":42,"tag":345,"props":588,"children":589},{},[590],{"type":48,"value":591},"Active Directory \u002F Kerberos \u002F domain join \u002F self-managed AD \u002F kinit \u002F SPN \u002F realm",{"type":42,"tag":345,"props":593,"children":594},{},[595],{"type":48,"value":596},"ad-kerberos",{"type":42,"tag":345,"props":598,"children":599},{},[600],{"type":42,"tag":359,"props":601,"children":603},{"href":602},"references\u002Fad-kerberos.md",[604],{"type":48,"value":605},"ad-kerberos.md",{"type":42,"tag":318,"props":607,"children":608},{},[609,614,619],{"type":42,"tag":345,"props":610,"children":611},{},[612],{"type":48,"value":613},"audit \u002F DB2_AUDIT \u002F audit policy \u002F audit to S3 \u002F option group",{"type":42,"tag":345,"props":615,"children":616},{},[617],{"type":48,"value":618},"db2-audit",{"type":42,"tag":345,"props":620,"children":621},{},[622],{"type":42,"tag":359,"props":623,"children":625},{"href":624},"references\u002Fdb2-audit.md",[626],{"type":48,"value":627},"db2-audit.md",{"type":42,"tag":318,"props":629,"children":630},{},[631,636,641],{"type":42,"tag":345,"props":632,"children":633},{},[634],{"type":48,"value":635},"minimum IAM \u002F least privilege \u002F IAM policy \u002F trust policy \u002F permissions",{"type":42,"tag":345,"props":637,"children":638},{},[639],{"type":48,"value":640},"minimum-iam",{"type":42,"tag":345,"props":642,"children":643},{},[644],{"type":42,"tag":359,"props":645,"children":647},{"href":646},"references\u002Fminimum-iam.md",[648],{"type":48,"value":649},"minimum-iam.md",{"type":42,"tag":318,"props":651,"children":652},{},[653,658,663],{"type":42,"tag":345,"props":654,"children":655},{},[656],{"type":48,"value":657},"colocation \u002F co-locate \u002F EC2 app latency \u002F ASG \u002F ALB \u002F failover routing",{"type":42,"tag":345,"props":659,"children":660},{},[661],{"type":48,"value":662},"colocation",{"type":42,"tag":345,"props":664,"children":665},{},[666],{"type":42,"tag":359,"props":667,"children":669},{"href":668},"references\u002Fcolocation.md",[670],{"type":48,"value":671},"colocation.md",{"type":42,"tag":58,"props":673,"children":674},{},[675],{"type":42,"tag":270,"props":676,"children":677},{},[678],{"type":48,"value":274},{"type":42,"tag":106,"props":680,"children":681},{},[682,687,692,697],{"type":42,"tag":110,"props":683,"children":684},{},[685],{"type":48,"value":686},"The agent MUST read only the reference files that match the user's question, to keep the context focused.",{"type":42,"tag":110,"props":688,"children":689},{},[690],{"type":48,"value":691},"The agent MUST NOT invent RDSADMIN procedure signatures, because wrong parameter order will fail at runtime — always cite the signature from the reference file.",{"type":42,"tag":110,"props":693,"children":694},{},[695],{"type":48,"value":696},"The agent MUST cite the source blog URL when an answer is blog-sourced, so the user can verify specifics.",{"type":42,"tag":110,"props":698,"children":699},{},[700],{"type":48,"value":701},"If a question crosses two sub-skills (e.g. \"migrate z\u002FOS with near-zero downtime\", or \"BYOK plus cross-region standby\"), the agent SHOULD load each matching reference and combine them.",{"type":42,"tag":94,"props":703,"children":705},{"id":704},"execute-workflow",[706],{"type":48,"value":707},"Execute Workflow",{"type":42,"tag":58,"props":709,"children":710},{},[711],{"type":48,"value":712},"Once routed, give the user a concrete, runnable answer grounded in the reference file.",{"type":42,"tag":58,"props":714,"children":715},{},[716],{"type":48,"value":717},"Parameter acquisition:",{"type":42,"tag":106,"props":719,"children":720},{},[721,734,763],{"type":42,"tag":110,"props":722,"children":723},{},[724,726,732],{"type":48,"value":725},"All required parameters (region, instance identifier, source\u002Ftarget ARNs, S3 bucket, prefix, the ",{"type":42,"tag":64,"props":727,"children":729},{"className":728},[],[730],{"type":48,"value":731},"--master-username",{"type":48,"value":733}," value) MUST be collected upfront in a single message.",{"type":42,"tag":110,"props":735,"children":736},{},[737,739,745,747,753,755,761],{"type":48,"value":738},"Parameter formats MUST be specified: region ",{"type":42,"tag":64,"props":740,"children":742},{"className":741},[],[743],{"type":48,"value":744},"us-east-1",{"type":48,"value":746},"-style; instance identifier ",{"type":42,"tag":64,"props":748,"children":750},{"className":749},[],[751],{"type":48,"value":752},"^[a-zA-Z][a-zA-Z0-9-]{0,62}$",{"type":48,"value":754},"; ARN ",{"type":42,"tag":64,"props":756,"children":758},{"className":757},[],[759],{"type":48,"value":760},"arn:aws:rds:\u003Cregion>:\u003Caccount>:db:\u003Cname>",{"type":48,"value":762},"; S3 bucket 3–63 chars lowercase.",{"type":42,"tag":110,"props":764,"children":765},{},[766],{"type":48,"value":767},"The agent MUST accept parameters via direct input, a JSON\u002FYAML file path, or a URL.",{"type":42,"tag":58,"props":769,"children":770},{},[771],{"type":48,"value":772},"Tool use:",{"type":42,"tag":106,"props":774,"children":775},{},[776,789,823],{"type":42,"tag":110,"props":777,"children":778},{},[779,781,787],{"type":48,"value":780},"Use AWS CLI for RDS operations (example: ",{"type":42,"tag":64,"props":782,"children":784},{"className":783},[],[785],{"type":48,"value":786},"aws rds create-db-instance-read-replica --db-instance-identifier \u003Cname> --source-db-instance-identifier \u003Carn> --replica-mode mounted --region \u003Cdr-region>",{"type":48,"value":788},"). Every operation is expressed in AWS CLI syntax so it runs whether or not the AWS MCP server is installed.",{"type":42,"tag":110,"props":790,"children":791},{},[792,794,800,801,807,808,814,815,821],{"type":48,"value":793},"Use bundled scripts — ",{"type":42,"tag":359,"props":795,"children":797},{"href":796},"scripts\u002Fdb2-driver.sh",[798],{"type":48,"value":799},"db2-driver.sh",{"type":48,"value":206},{"type":42,"tag":359,"props":802,"children":804},{"href":803},"scripts\u002Fdb2client-configure.sh",[805],{"type":48,"value":806},"db2client-configure.sh",{"type":48,"value":206},{"type":42,"tag":359,"props":809,"children":811},{"href":810},"scripts\u002Fdb2client-airgap.sh",[812],{"type":48,"value":813},"db2client-airgap.sh",{"type":48,"value":206},{"type":42,"tag":359,"props":816,"children":818},{"href":817},"scripts\u002Ffunctions.sh",[819],{"type":48,"value":820},"functions.sh",{"type":48,"value":822}," — instead of rewriting install steps.",{"type":42,"tag":110,"props":824,"children":825},{},[826,828,834],{"type":48,"value":827},"Write migration plans, upgrade plans, validation reports to a local ",{"type":42,"tag":64,"props":829,"children":831},{"className":830},[],[832],{"type":48,"value":833},"artifacts\u002F\u003Capp-name>\u002F",{"type":48,"value":835}," directory created at runtime in the working directory (this is a run-time output location, not part of the shipped skill).",{"type":42,"tag":58,"props":837,"children":838},{},[839],{"type":42,"tag":270,"props":840,"children":841},{},[842],{"type":48,"value":274},{"type":42,"tag":106,"props":844,"children":845},{},[846,851,856,861,873,885],{"type":42,"tag":110,"props":847,"children":848},{},[849],{"type":48,"value":850},"The agent MUST give exact CLI commands when behavior is deterministic, not descriptions like \"enable Multi-AZ\".",{"type":42,"tag":110,"props":852,"children":853},{},[854],{"type":48,"value":855},"The agent MUST obtain AWS credentials through an IAM role or instance profile and MUST NOT prompt the user to paste credentials.",{"type":42,"tag":110,"props":857,"children":858},{},[859],{"type":48,"value":860},"The agent MUST cite the source blog or documentation URL whenever the answer is sourced from published material, so the user can verify it.",{"type":42,"tag":110,"props":862,"children":863},{},[864,866,871],{"type":48,"value":865},"The agent MUST write long-form artifacts to a local ",{"type":42,"tag":64,"props":867,"children":869},{"className":868},[],[870],{"type":48,"value":833},{"type":48,"value":872}," directory (created at runtime in the working directory) so the workspace is inspectable.",{"type":42,"tag":110,"props":874,"children":875},{},[876,878,883],{"type":48,"value":877},"When a requested action is unsupported on managed RDS for Db2, the agent MUST state the limitation plainly — no hedging like \"limited support\" or \"with special config\" — and offer a supported alternative (for example, unfenced C\u002FCOBOL stored procedures are not supported; rewrite them in Java via ",{"type":42,"tag":64,"props":879,"children":881},{"className":880},[],[882],{"type":48,"value":69},{"type":48,"value":884},", or in SQL PL).",{"type":42,"tag":110,"props":886,"children":887},{},[888,890,896,898,903,905,911],{"type":48,"value":889},"The AWS MCP server is recommended but not required. When the MCP server is in use, prefer inline JSON strings over positional filesystem arguments with ",{"type":42,"tag":64,"props":891,"children":893},{"className":892},[],[894],{"type":48,"value":895},"call_aws",{"type":48,"value":897},"; this is guidance for the MCP path only, not a requirement. Never treat ",{"type":42,"tag":64,"props":899,"children":901},{"className":900},[],[902],{"type":48,"value":895},{"type":48,"value":904}," or ",{"type":42,"tag":64,"props":906,"children":908},{"className":907},[],[909],{"type":48,"value":910},"run_script",{"type":48,"value":912}," as the only way to perform an operation — the AWS CLI command always works on its own.",{"type":42,"tag":94,"props":914,"children":916},{"id":915},"resource-tagging-always-apply-on-resource-creation",[917],{"type":48,"value":918},"Resource tagging (always apply on resource creation)",{"type":42,"tag":58,"props":920,"children":921},{},[922,924,930,931,937,938,944,946,952,954,960],{"type":48,"value":923},"When creating any RDS for Db2 resource (",{"type":42,"tag":64,"props":925,"children":927},{"className":926},[],[928],{"type":48,"value":929},"create-db-instance",{"type":48,"value":206},{"type":42,"tag":64,"props":932,"children":934},{"className":933},[],[935],{"type":48,"value":936},"create-db-parameter-group",{"type":48,"value":206},{"type":42,"tag":64,"props":939,"children":941},{"className":940},[],[942],{"type":48,"value":943},"create-db-cluster",{"type":48,"value":945}," for Multi-AZ deployments, ",{"type":42,"tag":64,"props":947,"children":949},{"className":948},[],[950],{"type":48,"value":951},"create-db-instance-read-replica",{"type":48,"value":953}," for standby replicas), ALWAYS include these tags using the RDS list-of-records ",{"type":42,"tag":64,"props":955,"children":957},{"className":956},[],[958],{"type":48,"value":959},"--tags",{"type":48,"value":961}," syntax:",{"type":42,"tag":58,"props":963,"children":964},{},[965],{"type":42,"tag":64,"props":966,"children":968},{"className":967},[],[969],{"type":48,"value":970},"--tags Key=created_by,Value=rds-db2-skill Key=generation_model,Value={your-model-id}",{"type":42,"tag":58,"props":972,"children":973},{},[974,976],{"type":48,"value":975},"Example: ",{"type":42,"tag":64,"props":977,"children":979},{"className":978},[],[980],{"type":48,"value":981},"--tags Key=created_by,Value=rds-db2-skill Key=generation_model,Value=claude-sonnet-4-20250514",{"type":42,"tag":58,"props":983,"children":984},{},[985,987,993,995,1001,1003,1009,1011,1017],{"type":48,"value":986},"The same convention applies to every resource this skill creates, including BYOK-encrypted instances (",{"type":42,"tag":64,"props":988,"children":990},{"className":989},[],[991],{"type":48,"value":992},"create-db-instance --storage-encrypted --kms-key-id ...",{"type":48,"value":994},"), audit option groups (",{"type":42,"tag":64,"props":996,"children":998},{"className":997},[],[999],{"type":48,"value":1000},"create-option-group",{"type":48,"value":1002},"), and customer-managed KMS keys (",{"type":42,"tag":64,"props":1004,"children":1006},{"className":1005},[],[1007],{"type":48,"value":1008},"kms create-key",{"type":48,"value":1010},", tagged with ",{"type":42,"tag":64,"props":1012,"children":1014},{"className":1013},[],[1015],{"type":48,"value":1016},"--tags TagKey=created_by,TagValue=rds-db2-skill TagKey=generation_model,TagValue={your-model-id}",{"type":48,"value":1018}," per the KMS tag syntax).",{"type":42,"tag":58,"props":1020,"children":1021},{},[1022,1024,1030],{"type":48,"value":1023},"Include these tags even if the user does not mention tagging, so that they can identify the resources created via this skill. If the user provides additional tags, append these to their tags rather than replacing them. The same applies when tagging via ",{"type":42,"tag":64,"props":1025,"children":1027},{"className":1026},[],[1028],{"type":48,"value":1029},"add-tags-to-resource",{"type":48,"value":1031}," on existing resources.",{"type":42,"tag":51,"props":1033,"children":1035},{"id":1034},"rds-managed-facts-the-agent-must-always-surface",[1036],{"type":48,"value":1037},"RDS-managed facts the agent must always surface",{"type":42,"tag":58,"props":1039,"children":1040},{},[1041,1043,1049],{"type":48,"value":1042},"These RDS-for-Db2-specific facts are what differentiates this skill from general IBM Db2 knowledge. General-Db2 answers typically omit the RDS-managed constraints (no unfenced C\u002FCOBOL, Secrets Manager rotation side effects, ",{"type":42,"tag":64,"props":1044,"children":1046},{"className":1045},[],[1047],{"type":48,"value":1048},"rdsadmin.*",{"type":48,"value":1050}," procedures) and the AWS-native migration tooling nuances (DMS z\u002FOS limits, ADB2GEN vs SCT).",{"type":42,"tag":58,"props":1052,"children":1053},{},[1054],{"type":42,"tag":270,"props":1055,"children":1056},{},[1057],{"type":48,"value":1058},"For \"create cross-region standby replica for DR\", you MUST tell the user ALL of the following six facts:",{"type":42,"tag":1060,"props":1061,"children":1062},"ol",{},[1063,1094,1104,1114,1124,1142],{"type":42,"tag":110,"props":1064,"children":1065},{},[1066,1077,1079,1085,1087,1092],{"type":42,"tag":270,"props":1067,"children":1068},{},[1069,1071],{"type":48,"value":1070},"Use ",{"type":42,"tag":64,"props":1072,"children":1074},{"className":1073},[],[1075],{"type":48,"value":1076},"aws rds create-db-instance-read-replica",{"type":48,"value":1078}," with ",{"type":42,"tag":64,"props":1080,"children":1082},{"className":1081},[],[1083],{"type":48,"value":1084},"--replica-mode mounted",{"type":48,"value":1086}," and the cross-region source ARN — Db2 cross-region standby uses ",{"type":42,"tag":270,"props":1088,"children":1089},{},[1090],{"type":48,"value":1091},"mounted replica mode",{"type":48,"value":1093},", NOT transactional read-replica mode.",{"type":42,"tag":110,"props":1095,"children":1096},{},[1097,1102],{"type":42,"tag":270,"props":1098,"children":1099},{},[1100],{"type":48,"value":1101},"Source prerequisite: automated backups enabled",{"type":48,"value":1103}," on the source instance (backup retention period > 0).",{"type":42,"tag":110,"props":1105,"children":1106},{},[1107,1112],{"type":42,"tag":270,"props":1108,"children":1109},{},[1110],{"type":48,"value":1111},"Target-region prerequisite: custom parameter group",{"type":48,"value":1113}," created in the target region before the command runs.",{"type":42,"tag":110,"props":1115,"children":1116},{},[1117,1122],{"type":42,"tag":270,"props":1118,"children":1119},{},[1120],{"type":48,"value":1121},"Target-region prerequisite: KMS key",{"type":48,"value":1123}," available in the target region (multi-region KMS key or a target-region customer-managed KMS key).",{"type":42,"tag":110,"props":1125,"children":1126},{},[1127,1140],{"type":42,"tag":270,"props":1128,"children":1129},{},[1130,1132,1138],{"type":48,"value":1131},"State prerequisites: all databases in ",{"type":42,"tag":64,"props":1133,"children":1135},{"className":1134},[],[1136],{"type":48,"value":1137},"active",{"type":48,"value":1139}," state, no pending reboots",{"type":48,"value":1141},", no license-model restrictions blocking cross-region replicas.",{"type":42,"tag":110,"props":1143,"children":1144},{},[1145,1150],{"type":42,"tag":270,"props":1146,"children":1147},{},[1148],{"type":48,"value":1149},"Explain the mounted-vs-transactional distinction",{"type":48,"value":1151}," — mounted replicas do not accept reads or SQL from applications; they exist purely as a DR standby that can be promoted. Do not suggest read offload use cases.",{"type":42,"tag":58,"props":1153,"children":1154},{},[1155],{"type":42,"tag":270,"props":1156,"children":1157},{},[1158],{"type":48,"value":1159},"For \"restore Db2 backup from S3 (multi-part, N files)\", you MUST tell the user ALL of the following six facts — never omit any of the procedure names:",{"type":42,"tag":1060,"props":1161,"children":1162},{},[1163,1187,1226,1265,1303,1327],{"type":42,"tag":110,"props":1164,"children":1165},{},[1166,1177,1179,1185],{"type":42,"tag":270,"props":1167,"children":1168},{},[1169,1171],{"type":48,"value":1170},"Attach IAM role with S3 access via ",{"type":42,"tag":64,"props":1172,"children":1174},{"className":1173},[],[1175],{"type":48,"value":1176},"aws rds add-role-to-db-instance",{"type":48,"value":1178}," using ",{"type":42,"tag":64,"props":1180,"children":1182},{"className":1181},[],[1183],{"type":48,"value":1184},"--feature-name S3_INTEGRATION",{"type":48,"value":1186},".",{"type":42,"tag":110,"props":1188,"children":1189},{},[1190,1201,1203,1209,1210,1216,1218,1224],{"type":42,"tag":270,"props":1191,"children":1192},{},[1193,1195],{"type":48,"value":1194},"Set restore performance parameters via ",{"type":42,"tag":64,"props":1196,"children":1198},{"className":1197},[],[1199],{"type":48,"value":1200},"rdsadmin.set_configuration",{"type":48,"value":1202}," — tune ",{"type":42,"tag":64,"props":1204,"children":1206},{"className":1205},[],[1207],{"type":48,"value":1208},"USE_STREAMING_RESTORE",{"type":48,"value":206},{"type":42,"tag":64,"props":1211,"children":1213},{"className":1212},[],[1214],{"type":48,"value":1215},"RESTORE_DATABASE_NUM_BUFFERS",{"type":48,"value":1217},", and ",{"type":42,"tag":64,"props":1219,"children":1221},{"className":1220},[],[1222],{"type":48,"value":1223},"PARALLELISM",{"type":48,"value":1225}," before starting the restore.",{"type":42,"tag":110,"props":1227,"children":1228},{},[1229,1240,1242,1248,1249,1255,1257,1263],{"type":42,"tag":270,"props":1230,"children":1231},{},[1232,1234],{"type":48,"value":1233},"Call ",{"type":42,"tag":64,"props":1235,"children":1237},{"className":1236},[],[1238],{"type":48,"value":1239},"rdsadmin.restore_database",{"type":48,"value":1241}," with five parameters in this exact order: database name, restore mode (",{"type":42,"tag":64,"props":1243,"children":1245},{"className":1244},[],[1246],{"type":48,"value":1247},"OFFLINE",{"type":48,"value":904},{"type":42,"tag":64,"props":1250,"children":1252},{"className":1251},[],[1253],{"type":48,"value":1254},"ONLINE",{"type":48,"value":1256},"), S3 prefix, S3 bucket, and region. Multi-file (multi-part) backups are handled by the shared prefix — there is no separate multi-part flag parameter. (Signature: ",{"type":42,"tag":64,"props":1258,"children":1260},{"className":1259},[],[1261],{"type":48,"value":1262},"rdsadmin.restore_database(dbname, type, prefix, bucket, region)",{"type":48,"value":1264},".)",{"type":42,"tag":110,"props":1266,"children":1267},{},[1268,1286,1288,1294,1296,1301],{"type":42,"tag":270,"props":1269,"children":1270},{},[1271,1273,1278,1280],{"type":48,"value":1272},"For ",{"type":42,"tag":64,"props":1274,"children":1276},{"className":1275},[],[1277],{"type":48,"value":1254},{"type":48,"value":1279}," restore mode, follow up with ",{"type":42,"tag":64,"props":1281,"children":1283},{"className":1282},[],[1284],{"type":48,"value":1285},"rdsadmin.rollforward_database",{"type":48,"value":1287}," to replay archive logs, then ",{"type":42,"tag":64,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":48,"value":1293},"rdsadmin.complete_rollforward",{"type":48,"value":1295}," to finish. ",{"type":42,"tag":64,"props":1297,"children":1299},{"className":1298},[],[1300],{"type":48,"value":1247},{"type":48,"value":1302}," restores do NOT need rollforward.",{"type":42,"tag":110,"props":1304,"children":1305},{},[1306,1317,1319,1325],{"type":42,"tag":270,"props":1307,"children":1308},{},[1309,1311],{"type":48,"value":1310},"Monitor progress with ",{"type":42,"tag":64,"props":1312,"children":1314},{"className":1313},[],[1315],{"type":48,"value":1316},"rdsadmin.get_task_status",{"type":48,"value":1318}," — every ",{"type":42,"tag":64,"props":1320,"children":1322},{"className":1321},[],[1323],{"type":48,"value":1324},"rdsadmin",{"type":48,"value":1326}," procedure returns a task ID you poll.",{"type":42,"tag":110,"props":1328,"children":1329},{},[1330,1335,1337,1342],{"type":42,"tag":270,"props":1331,"children":1332},{},[1333],{"type":48,"value":1334},"Warn about VPC endpoint for S3 if no internet egress",{"type":48,"value":1336}," from the private subnet, and warn about ",{"type":42,"tag":270,"props":1338,"children":1339},{},[1340],{"type":48,"value":1341},"Db2 version compatibility",{"type":48,"value":1343}," between the source backup and the RDS instance engine version (forward-compatible, not backward).",{"type":42,"tag":58,"props":1345,"children":1346},{},[1347],{"type":42,"tag":270,"props":1348,"children":1349},{},[1350],{"type":48,"value":1351},"For \"C\u002FCOBOL unfenced external stored procedures — lift and shift to RDS for Db2?\", you MUST tell the user ALL of the following four facts:",{"type":42,"tag":1060,"props":1353,"children":1354},{},[1355,1365,1375,1399],{"type":42,"tag":110,"props":1356,"children":1357},{},[1358,1363],{"type":42,"tag":270,"props":1359,"children":1360},{},[1361],{"type":48,"value":1362},"Unfenced external stored procedures in C and COBOL are NOT supported on RDS for Db2.",{"type":48,"value":1364}," State this as an unqualified \"not supported\" — do not hedge with \"limited support\" or \"with special config.\"",{"type":42,"tag":110,"props":1366,"children":1367},{},[1368,1373],{"type":42,"tag":270,"props":1369,"children":1370},{},[1371],{"type":48,"value":1372},"All routines on RDS for Db2 MUST be fenced.",{"type":48,"value":1374}," This is a managed-service architectural constraint, not a flag.",{"type":42,"tag":110,"props":1376,"children":1377},{},[1378,1383,1385,1390,1392,1397],{"type":42,"tag":270,"props":1379,"children":1380},{},[1381],{"type":48,"value":1382},"Java stored procedures are supported",{"type":48,"value":1384}," — install via ",{"type":42,"tag":64,"props":1386,"children":1388},{"className":1387},[],[1389],{"type":48,"value":69},{"type":48,"value":1391},". C\u002FCOBOL SPs should be ",{"type":42,"tag":270,"props":1393,"children":1394},{},[1395],{"type":48,"value":1396},"rewritten in Java or SQL PL",{"type":48,"value":1398}," (Db2's procedural SQL, equivalent to Oracle's PL\u002FSQL).",{"type":42,"tag":110,"props":1400,"children":1401},{},[1402,1407],{"type":42,"tag":270,"props":1403,"children":1404},{},[1405],{"type":48,"value":1406},"Offer to help identify which SPs are unfenced",{"type":48,"value":1408}," and prioritize the rewrite by call frequency (hot code path first).",{"type":42,"tag":58,"props":1410,"children":1411},{},[1412],{"type":42,"tag":270,"props":1413,"children":1414},{},[1415],{"type":48,"value":1416},"For \"migrate Db2 for z\u002FOS to RDS for Db2 with near-zero downtime\", you MUST tell the user ALL of the following five facts:",{"type":42,"tag":1060,"props":1418,"children":1419},{},[1420,1430,1440,1450,1460],{"type":42,"tag":110,"props":1421,"children":1422},{},[1423,1428],{"type":42,"tag":270,"props":1424,"children":1425},{},[1426],{"type":48,"value":1427},"For near-zero-downtime from z\u002FOS, use Q Replication (IBM IIDR), Qlik Replicate, or Precisely",{"type":48,"value":1429}," — these are the CDC tools that support Db2 for z\u002FOS as a source streaming to RDS for Db2.",{"type":42,"tag":110,"props":1431,"children":1432},{},[1433,1438],{"type":42,"tag":270,"props":1434,"children":1435},{},[1436],{"type":48,"value":1437},"AWS DMS supports FULL LOAD ONLY from Db2 for z\u002FOS.",{"type":48,"value":1439}," DMS does NOT support CDC from z\u002FOS sources. Use DMS for a one-time bulk load, not for near-zero-downtime cutover.",{"type":42,"tag":110,"props":1441,"children":1442},{},[1443,1448],{"type":42,"tag":270,"props":1444,"children":1445},{},[1446],{"type":48,"value":1447},"Use ADB2GEN for schema conversion from z\u002FOS.",{"type":48,"value":1449}," AWS SCT does NOT support Db2 for z\u002FOS as a source — this is a common trap. Do not recommend SCT for z\u002FOS sources.",{"type":42,"tag":110,"props":1451,"children":1452},{},[1453,1458],{"type":42,"tag":270,"props":1454,"children":1455},{},[1456],{"type":48,"value":1457},"Code-page conversion (EBCDIC → UTF-8) is the primary migration risk.",{"type":48,"value":1459}," Plan explicit collation and code page mapping before cutover — silent data corruption is the failure mode.",{"type":42,"tag":110,"props":1461,"children":1462},{},[1463,1468],{"type":42,"tag":270,"props":1464,"children":1465},{},[1466],{"type":48,"value":1467},"Plan explicit collation selection",{"type":48,"value":1469}," on the target RDS instance to match the semantic ordering of the z\u002FOS source.",{"type":42,"tag":58,"props":1471,"children":1472},{},[1473],{"type":42,"tag":270,"props":1474,"children":1475},{},[1476],{"type":48,"value":1477},"For \"SQL30082N — USERNAME AND\u002FOR PASSWORD INVALID\" with RDS-managed master user (user didn't change it), you MUST tell the user ALL of the following four facts:",{"type":42,"tag":1060,"props":1479,"children":1480},{},[1481,1491,1522,1538],{"type":42,"tag":110,"props":1482,"children":1483},{},[1484,1489],{"type":42,"tag":270,"props":1485,"children":1486},{},[1487],{"type":48,"value":1488},"SQL30082N after a previously-working connection almost always means the master password rotated in Secrets Manager.",{"type":48,"value":1490}," RDS for Db2 rotates the master password on the Secrets Manager schedule — clients using a cached password will start failing with SQL30082N even though nothing on their side changed.",{"type":42,"tag":110,"props":1492,"children":1493},{},[1494,1505,1507,1512,1514,1520],{"type":42,"tag":270,"props":1495,"children":1496},{},[1497,1499],{"type":48,"value":1498},"Fix: run ",{"type":42,"tag":64,"props":1500,"children":1502},{"className":1501},[],[1503],{"type":48,"value":1504},"db2_use \u003Cinstance-id>",{"type":48,"value":1506}," (from ",{"type":42,"tag":64,"props":1508,"children":1510},{"className":1509},[],[1511],{"type":48,"value":820},{"type":48,"value":1513}," \u002F the bundled helpers). This fetches the current password from Secrets Manager and rewrites ",{"type":42,"tag":64,"props":1515,"children":1517},{"className":1516},[],[1518],{"type":48,"value":1519},"~\u002F.db2env",{"type":48,"value":1521}," with the new value.",{"type":42,"tag":110,"props":1523,"children":1524},{},[1525,1536],{"type":42,"tag":270,"props":1526,"children":1527},{},[1528,1530],{"type":48,"value":1529},"Alternative: ",{"type":42,"tag":64,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":48,"value":1535},"db2_test_connection",{"type":48,"value":1537}," to verify the helper's fix worked end-to-end.",{"type":42,"tag":110,"props":1539,"children":1540},{},[1541,1554,1556,1562],{"type":42,"tag":270,"props":1542,"children":1543},{},[1544,1546,1552],{"type":48,"value":1545},"If ",{"type":42,"tag":64,"props":1547,"children":1549},{"className":1548},[],[1550],{"type":48,"value":1551},"db2_use",{"type":48,"value":1553}," isn't installed",{"type":48,"value":1555},", the user needs to pull the current password with ",{"type":42,"tag":64,"props":1557,"children":1559},{"className":1558},[],[1560],{"type":48,"value":1561},"aws secretsmanager get-secret-value",{"type":48,"value":1563}," and update their local credential cache manually. Do not tell them to rotate the password — the password rotation is what caused the problem.",{"type":42,"tag":58,"props":1565,"children":1566},{},[1567],{"type":42,"tag":270,"props":1568,"children":1569},{},[1570],{"type":48,"value":1571},"For \"BYOK \u002F customer-managed KMS key for RDS for Db2\", you MUST tell the user ALL of the following six facts:",{"type":42,"tag":1060,"props":1573,"children":1574},{},[1575,1591,1615,1654,1679,1704],{"type":42,"tag":110,"props":1576,"children":1577},{},[1578,1589],{"type":42,"tag":270,"props":1579,"children":1580},{},[1581,1583],{"type":48,"value":1582},"Use a multi-region KMS key with ",{"type":42,"tag":64,"props":1584,"children":1586},{"className":1585},[],[1587],{"type":48,"value":1588},"--origin EXTERNAL",{"type":48,"value":1590}," when importing your own key material, so the same key ID and material can replicate to a DR region.",{"type":42,"tag":110,"props":1592,"children":1593},{},[1594,1613],{"type":42,"tag":270,"props":1595,"children":1596},{},[1597,1599,1605,1607],{"type":48,"value":1598},"The creating principal needs ",{"type":42,"tag":64,"props":1600,"children":1602},{"className":1601},[],[1603],{"type":48,"value":1604},"kms:CreateGrant",{"type":48,"value":1606}," and ",{"type":42,"tag":64,"props":1608,"children":1610},{"className":1609},[],[1611],{"type":48,"value":1612},"kms:DescribeKey",{"type":48,"value":1614}," on the key, or instance creation fails.",{"type":42,"tag":110,"props":1616,"children":1617},{},[1618,1623,1624,1630,1632,1637,1639,1645,1647,1653],{"type":42,"tag":270,"props":1619,"children":1620},{},[1621],{"type":48,"value":1622},"Encryption is set at instance creation",{"type":48,"value":1078},{"type":42,"tag":64,"props":1625,"children":1627},{"className":1626},[],[1628],{"type":48,"value":1629},"--storage-encrypted --kms-key-id \u003Calias|arn>",{"type":48,"value":1631},". You ",{"type":42,"tag":270,"props":1633,"children":1634},{},[1635],{"type":48,"value":1636},"cannot encrypt an existing unencrypted instance in place",{"type":48,"value":1638}," — go snapshot → ",{"type":42,"tag":64,"props":1640,"children":1642},{"className":1641},[],[1643],{"type":48,"value":1644},"copy-db-snapshot --kms-key-id",{"type":48,"value":1646}," → ",{"type":42,"tag":64,"props":1648,"children":1650},{"className":1649},[],[1651],{"type":48,"value":1652},"restore-db-instance-from-db-snapshot",{"type":48,"value":1186},{"type":42,"tag":110,"props":1655,"children":1656},{},[1657,1669,1671,1677],{"type":42,"tag":270,"props":1658,"children":1659},{},[1660,1662,1668],{"type":48,"value":1661},"For cross-region DR, replicate the multi-region key (",{"type":42,"tag":64,"props":1663,"children":1665},{"className":1664},[],[1666],{"type":48,"value":1667},"kms:ReplicateKey",{"type":48,"value":244},{"type":48,"value":1670}," into the DR region first, then ",{"type":42,"tag":64,"props":1672,"children":1674},{"className":1673},[],[1675],{"type":48,"value":1676},"copy-db-snapshot",{"type":48,"value":1678}," across regions with the replica key.",{"type":42,"tag":110,"props":1680,"children":1681},{},[1682,1687,1689,1695,1697,1702],{"type":42,"tag":270,"props":1683,"children":1684},{},[1685],{"type":48,"value":1686},"Import tokens expire after 24 hours",{"type":48,"value":1688}," — if ",{"type":42,"tag":64,"props":1690,"children":1692},{"className":1691},[],[1693],{"type":48,"value":1694},"import-key-material",{"type":48,"value":1696}," fails on expiry, re-run ",{"type":42,"tag":64,"props":1698,"children":1700},{"className":1699},[],[1701],{"type":48,"value":191},{"type":48,"value":1703}," to get a fresh token and wrapping key.",{"type":42,"tag":110,"props":1705,"children":1706},{},[1707,1716],{"type":42,"tag":270,"props":1708,"children":1709},{},[1710,1712],{"type":48,"value":1711},"Cite blog DBBLOG-5188 and ",{"type":42,"tag":359,"props":1713,"children":1714},{"href":580},[1715],{"type":48,"value":583},{"type":48,"value":1717},"; do not invent KMS parameter names.",{"type":42,"tag":58,"props":1719,"children":1720},{},[1721],{"type":42,"tag":270,"props":1722,"children":1723},{},[1724],{"type":48,"value":1725},"For \"self-managed Active Directory with Kerberos on RDS for Db2\", you MUST tell the user ALL of the following six facts:",{"type":42,"tag":1060,"props":1727,"children":1728},{},[1729,1766,1833,1865,1875,1930],{"type":42,"tag":110,"props":1730,"children":1731},{},[1732,1764],{"type":42,"tag":270,"props":1733,"children":1734},{},[1735,1737,1743,1744,1750,1751,1757,1758],{"type":48,"value":1736},"RDS joins your AD via ",{"type":42,"tag":64,"props":1738,"children":1740},{"className":1739},[],[1741],{"type":48,"value":1742},"--domain-fqdn",{"type":48,"value":206},{"type":42,"tag":64,"props":1745,"children":1747},{"className":1746},[],[1748],{"type":48,"value":1749},"--domain-ou",{"type":48,"value":206},{"type":42,"tag":64,"props":1752,"children":1754},{"className":1753},[],[1755],{"type":48,"value":1756},"--domain-auth-secret-arn",{"type":48,"value":1217},{"type":42,"tag":64,"props":1759,"children":1761},{"className":1760},[],[1762],{"type":48,"value":1763},"--domain-dns-ips",{"type":48,"value":1765}," — the self-managed AD path, with no AWS Managed Microsoft AD required.",{"type":42,"tag":110,"props":1767,"children":1768},{},[1769,1780,1782,1795,1797,1808,1810,1816,1818,1824,1825,1831],{"type":42,"tag":270,"props":1770,"children":1771},{},[1772,1774],{"type":48,"value":1773},"The Secrets Manager secret uses keys ",{"type":42,"tag":64,"props":1775,"children":1777},{"className":1776},[],[1778],{"type":48,"value":1779},"SELF_MANAGED_ACTIVE_DIRECTORY_USERNAME",{"type":48,"value":1781}," (the sAMAccountName only — ",{"type":42,"tag":270,"props":1783,"children":1784},{},[1785,1787,1793],{"type":48,"value":1786},"no ",{"type":42,"tag":64,"props":1788,"children":1790},{"className":1789},[],[1791],{"type":48,"value":1792},"DOMAIN\\",{"type":48,"value":1794}," prefix",{"type":48,"value":1796},", which fails creation) ",{"type":42,"tag":270,"props":1798,"children":1799},{},[1800,1802],{"type":48,"value":1801},"and ",{"type":42,"tag":64,"props":1803,"children":1805},{"className":1804},[],[1806],{"type":48,"value":1807},"SELF_MANAGED_ACTIVE_DIRECTORY_PASSWORD",{"type":48,"value":1809},", encrypted by a dedicated KMS key, with a resource policy trusting ",{"type":42,"tag":64,"props":1811,"children":1813},{"className":1812},[],[1814],{"type":48,"value":1815},"rds.amazonaws.com",{"type":48,"value":1817}," guarded by ",{"type":42,"tag":64,"props":1819,"children":1821},{"className":1820},[],[1822],{"type":48,"value":1823},"aws:SourceArn",{"type":48,"value":1606},{"type":42,"tag":64,"props":1826,"children":1828},{"className":1827},[],[1829],{"type":48,"value":1830},"aws:SourceAccount",{"type":48,"value":1832}," (confused-deputy protection).",{"type":42,"tag":110,"props":1834,"children":1835},{},[1836,1841,1843,1849,1851,1856,1858,1863],{"type":42,"tag":270,"props":1837,"children":1838},{},[1839],{"type":48,"value":1840},"Delegate the nine AD permissions",{"type":48,"value":1842}," to a dedicated service account scoped to one OU; grant ",{"type":42,"tag":64,"props":1844,"children":1846},{"className":1845},[],[1847],{"type":48,"value":1848},"servicePrincipalName",{"type":48,"value":1850}," read\u002Fwrite on ",{"type":42,"tag":270,"props":1852,"children":1853},{},[1854],{"type":48,"value":1855},"User",{"type":48,"value":1857}," objects using ",{"type":42,"tag":270,"props":1859,"children":1860},{},[1861],{"type":48,"value":1862},"ADSI Edit",{"type":48,"value":1864},", not the ADUC delegation wizard (which filters that attribute out) — this is the most common failure.",{"type":42,"tag":110,"props":1866,"children":1867},{},[1868,1873],{"type":42,"tag":270,"props":1869,"children":1870},{},[1871],{"type":48,"value":1872},"Open AD ports between RDS and the domain controllers: DNS 53, Kerberos 88 and 464, LDAP 389 and 3268, and the RPC range 49152–65535.",{"type":48,"value":1874}," Missing the RPC range is the top cause of intermittent join failures. Keep clock skew under 5 minutes.",{"type":42,"tag":110,"props":1876,"children":1877},{},[1878,1883,1885,1890,1892,1898,1900,1905,1907,1912,1914,1920,1922,1928],{"type":42,"tag":270,"props":1879,"children":1880},{},[1881],{"type":48,"value":1882},"The RDS master user is a local account that cannot get a Kerberos ticket.",{"type":48,"value":1884}," AD users need ",{"type":42,"tag":64,"props":1886,"children":1888},{"className":1887},[],[1889],{"type":48,"value":234},{"type":48,"value":1891}," plus a ",{"type":42,"tag":64,"props":1893,"children":1895},{"className":1894},[],[1896],{"type":48,"value":1897},"GRANT CONNECT",{"type":48,"value":1899},". Kerberos JDBC uses ",{"type":42,"tag":64,"props":1901,"children":1903},{"className":1902},[],[1904],{"type":48,"value":263},{"type":48,"value":1906}," and a ",{"type":42,"tag":270,"props":1908,"children":1909},{},[1910],{"type":48,"value":1911},"region-specific PEM",{"type":48,"value":1913}," via ",{"type":42,"tag":64,"props":1915,"children":1917},{"className":1916},[],[1918],{"type":48,"value":1919},"sslCertLocation",{"type":48,"value":1921}," (never ",{"type":42,"tag":64,"props":1923,"children":1925},{"className":1924},[],[1926],{"type":48,"value":1927},"global-bundle.pem",{"type":48,"value":1929},").",{"type":42,"tag":110,"props":1931,"children":1932},{},[1933,1942,1944,1950,1952,1958],{"type":42,"tag":270,"props":1934,"children":1935},{},[1936,1938],{"type":48,"value":1937},"Cite the self-managed AD blog and ",{"type":42,"tag":359,"props":1939,"children":1940},{"href":602},[1941],{"type":48,"value":605},{"type":48,"value":1943},"; verify with ",{"type":42,"tag":64,"props":1945,"children":1947},{"className":1946},[],[1948],{"type":48,"value":1949},"describe-db-instances ... DomainMemberships",{"type":48,"value":1951}," showing ",{"type":42,"tag":64,"props":1953,"children":1955},{"className":1954},[],[1956],{"type":48,"value":1957},"Status: joined",{"type":48,"value":1186},{"type":42,"tag":51,"props":1960,"children":1962},{"id":1961},"troubleshooting",[1963],{"type":48,"value":1964},"Troubleshooting",{"type":42,"tag":310,"props":1966,"children":1967},{},[1968,1989],{"type":42,"tag":314,"props":1969,"children":1970},{},[1971],{"type":42,"tag":318,"props":1972,"children":1973},{},[1974,1979,1984],{"type":42,"tag":322,"props":1975,"children":1976},{},[1977],{"type":48,"value":1978},"Error",{"type":42,"tag":322,"props":1980,"children":1981},{},[1982],{"type":48,"value":1983},"Cause",{"type":42,"tag":322,"props":1985,"children":1986},{},[1987],{"type":48,"value":1988},"Fix",{"type":42,"tag":338,"props":1990,"children":1991},{},[1992,2027,2060,2084,2116,2147,2177,2202,2253,2295],{"type":42,"tag":318,"props":1993,"children":1994},{},[1995,2004,2009],{"type":42,"tag":345,"props":1996,"children":1997},{},[1998],{"type":42,"tag":64,"props":1999,"children":2001},{"className":2000},[],[2002],{"type":48,"value":2003},"SQL30082N",{"type":42,"tag":345,"props":2005,"children":2006},{},[2007],{"type":48,"value":2008},"Password rotated in Secrets Manager",{"type":42,"tag":345,"props":2010,"children":2011},{},[2012,2014,2019,2021,2026],{"type":48,"value":2013},"Run ",{"type":42,"tag":64,"props":2015,"children":2017},{"className":2016},[],[2018],{"type":48,"value":1504},{"type":48,"value":2020}," — the helper re-fetches the current password and rewrites ",{"type":42,"tag":64,"props":2022,"children":2024},{"className":2023},[],[2025],{"type":48,"value":1519},{"type":48,"value":1186},{"type":42,"tag":318,"props":2028,"children":2029},{},[2030,2039,2044],{"type":42,"tag":345,"props":2031,"children":2032},{},[2033],{"type":42,"tag":64,"props":2034,"children":2036},{"className":2035},[],[2037],{"type":48,"value":2038},"SQL1531N",{"type":42,"tag":345,"props":2040,"children":2041},{},[2042],{"type":48,"value":2043},"DSN not yet in cache",{"type":42,"tag":345,"props":2045,"children":2046},{},[2047,2053,2055,2059],{"type":42,"tag":64,"props":2048,"children":2050},{"className":2049},[],[2051],{"type":48,"value":2052},"db2 terminate",{"type":48,"value":2054}," to clear, then retry; if still failing, re-run ",{"type":42,"tag":359,"props":2056,"children":2057},{"href":803},[2058],{"type":48,"value":806},{"type":48,"value":1186},{"type":42,"tag":318,"props":2061,"children":2062},{},[2063,2074,2079],{"type":42,"tag":345,"props":2064,"children":2065},{},[2066,2072],{"type":42,"tag":64,"props":2067,"children":2069},{"className":2068},[],[2070],{"type":48,"value":2071},"SQL01013N",{"type":48,"value":2073}," \u002F TCP timeout",{"type":42,"tag":345,"props":2075,"children":2076},{},[2077],{"type":48,"value":2078},"Security group blocks 50000\u002F50443",{"type":42,"tag":345,"props":2080,"children":2081},{},[2082],{"type":48,"value":2083},"Check SG inbound rules — add client's SG on TCP 50000 (plain) or 50443 (SSL).",{"type":42,"tag":318,"props":2085,"children":2086},{},[2087,2092,2097],{"type":42,"tag":345,"props":2088,"children":2089},{},[2090],{"type":48,"value":2091},"GSKit \u002F SSL certificate error",{"type":42,"tag":345,"props":2093,"children":2094},{},[2095],{"type":48,"value":2096},"RDS cert bundle missing or RSA cert not first",{"type":42,"tag":345,"props":2098,"children":2099},{},[2100,2102,2108,2110,2115],{"type":48,"value":2101},"Re-download ",{"type":42,"tag":64,"props":2103,"children":2105},{"className":2104},[],[2106],{"type":48,"value":2107},"\u003Cregion>-bundle.pem",{"type":48,"value":2109}," from RDS truststore and re-run ",{"type":42,"tag":64,"props":2111,"children":2113},{"className":2112},[],[2114],{"type":48,"value":806},{"type":48,"value":1186},{"type":42,"tag":318,"props":2117,"children":2118},{},[2119,2124,2137],{"type":42,"tag":345,"props":2120,"children":2121},{},[2122],{"type":48,"value":2123},"Access denied on RDSADMIN call",{"type":42,"tag":345,"props":2125,"children":2126},{},[2127,2129,2135],{"type":48,"value":2128},"IAM role missing ",{"type":42,"tag":64,"props":2130,"children":2132},{"className":2131},[],[2133],{"type":48,"value":2134},"S3_INTEGRATION",{"type":48,"value":2136}," feature",{"type":42,"tag":345,"props":2138,"children":2139},{},[2140,2146],{"type":42,"tag":64,"props":2141,"children":2143},{"className":2142},[],[2144],{"type":48,"value":2145},"aws rds add-role-to-db-instance --feature-name S3_INTEGRATION --role-arn \u003Crole-arn> --db-instance-identifier \u003Cid>",{"type":48,"value":1186},{"type":42,"tag":318,"props":2148,"children":2149},{},[2150,2155,2160],{"type":42,"tag":345,"props":2151,"children":2152},{},[2153],{"type":48,"value":2154},"Restore fails with \"database in rollforward pending\"",{"type":42,"tag":345,"props":2156,"children":2157},{},[2158],{"type":48,"value":2159},"ONLINE restore left DB in rollforward state",{"type":42,"tag":345,"props":2161,"children":2162},{},[2163,2164,2169,2171,2176],{"type":48,"value":1233},{"type":42,"tag":64,"props":2165,"children":2167},{"className":2166},[],[2168],{"type":48,"value":1285},{"type":48,"value":2170}," for each archive log, then ",{"type":42,"tag":64,"props":2172,"children":2174},{"className":2173},[],[2175],{"type":48,"value":1293},{"type":48,"value":1186},{"type":42,"tag":318,"props":2178,"children":2179},{},[2180,2185,2190],{"type":42,"tag":345,"props":2181,"children":2182},{},[2183],{"type":48,"value":2184},"Standby replica creation fails",{"type":42,"tag":345,"props":2186,"children":2187},{},[2188],{"type":48,"value":2189},"Missing prereqs",{"type":42,"tag":345,"props":2191,"children":2192},{},[2193,2195,2200],{"type":48,"value":2194},"Verify: automated backups enabled, custom parameter group in DR region, KMS multi-region key, no pending ",{"type":42,"tag":64,"props":2196,"children":2198},{"className":2197},[],[2199],{"type":48,"value":1324},{"type":48,"value":2201}," tasks, all databases in active state.",{"type":42,"tag":318,"props":2203,"children":2204},{},[2205,2224,2229],{"type":42,"tag":345,"props":2206,"children":2207},{},[2208,2210,2216,2218],{"type":48,"value":2209},"AD domain join ",{"type":42,"tag":64,"props":2211,"children":2213},{"className":2212},[],[2214],{"type":48,"value":2215},"Status",{"type":48,"value":2217}," not ",{"type":42,"tag":64,"props":2219,"children":2221},{"className":2220},[],[2222],{"type":48,"value":2223},"joined",{"type":42,"tag":345,"props":2225,"children":2226},{},[2227],{"type":48,"value":2228},"RPC port range blocked, wrong secret format, or SPN attribute missing",{"type":42,"tag":345,"props":2230,"children":2231},{},[2232,2234,2239,2241,2246,2248,2252],{"type":48,"value":2233},"Open RPC 49152–65535 between RDS and the DCs, confirm the secret username is the sAMAccountName with no ",{"type":42,"tag":64,"props":2235,"children":2237},{"className":2236},[],[2238],{"type":48,"value":1792},{"type":48,"value":2240}," prefix, and grant ",{"type":42,"tag":64,"props":2242,"children":2244},{"className":2243},[],[2245],{"type":48,"value":1848},{"type":48,"value":2247}," on User objects via ADSI Edit — see ",{"type":42,"tag":359,"props":2249,"children":2250},{"href":602},[2251],{"type":48,"value":605},{"type":48,"value":1186},{"type":42,"tag":318,"props":2254,"children":2255},{},[2256,2266,2271],{"type":42,"tag":345,"props":2257,"children":2258},{},[2259,2264],{"type":42,"tag":64,"props":2260,"children":2262},{"className":2261},[],[2263],{"type":48,"value":1694},{"type":48,"value":2265}," fails — token expired",{"type":42,"tag":345,"props":2267,"children":2268},{},[2269],{"type":48,"value":2270},"Import token older than 24 hours",{"type":42,"tag":345,"props":2272,"children":2273},{},[2274,2276,2281,2283,2288,2290,2294],{"type":48,"value":2275},"Re-run ",{"type":42,"tag":64,"props":2277,"children":2279},{"className":2278},[],[2280],{"type":48,"value":191},{"type":48,"value":2282}," for a fresh token and wrapping key, re-wrap the material with ",{"type":42,"tag":64,"props":2284,"children":2286},{"className":2285},[],[2287],{"type":48,"value":175},{"type":48,"value":2289},", then retry the import — see ",{"type":42,"tag":359,"props":2291,"children":2292},{"href":580},[2293],{"type":48,"value":583},{"type":48,"value":1186},{"type":42,"tag":318,"props":2296,"children":2297},{},[2298,2303,2308],{"type":42,"tag":345,"props":2299,"children":2300},{},[2301],{"type":48,"value":2302},"Throttling from RDS API",{"type":42,"tag":345,"props":2304,"children":2305},{},[2306],{"type":48,"value":2307},"Exceeded API request rate",{"type":42,"tag":345,"props":2309,"children":2310},{},[2311],{"type":48,"value":2312},"Exponential backoff with jitter; batch operations; check Service Quotas.",{"type":42,"tag":51,"props":2314,"children":2316},{"id":2315},"security-considerations",[2317],{"type":48,"value":2318},"Security Considerations",{"type":42,"tag":58,"props":2320,"children":2321},{},[2322],{"type":48,"value":2323},"Surface these controls when advising on any production RDS for Db2 deployment. They consolidate the security guidance that the sub-skill references cover in depth.",{"type":42,"tag":106,"props":2325,"children":2326},{},[2327,2363,2395,2419,2435,2460],{"type":42,"tag":110,"props":2328,"children":2329},{},[2330,2335,2337,2343,2345,2350,2352,2356,2357,2361],{"type":42,"tag":270,"props":2331,"children":2332},{},[2333],{"type":48,"value":2334},"Encryption at rest and in transit",{"type":48,"value":2336}," — Always create instances with ",{"type":42,"tag":64,"props":2338,"children":2340},{"className":2339},[],[2341],{"type":48,"value":2342},"--storage-encrypted",{"type":48,"value":2344},"; for key ownership and compliance use a customer-managed KMS key (BYOK), and for DR use a multi-region key. Enforce TLS on every connection (port 50443, ",{"type":42,"tag":64,"props":2346,"children":2348},{"className":2347},[],[2349],{"type":48,"value":2107},{"type":48,"value":2351},"); never connect in plaintext for production. See ",{"type":42,"tag":359,"props":2353,"children":2354},{"href":580},[2355],{"type":48,"value":583},{"type":48,"value":1606},{"type":42,"tag":359,"props":2358,"children":2359},{"href":405},[2360],{"type":48,"value":408},{"type":48,"value":2362},". (Guideline 1)",{"type":42,"tag":110,"props":2364,"children":2365},{},[2366,2371,2373,2377,2379,2385,2387,2393],{"type":42,"tag":270,"props":2367,"children":2368},{},[2369],{"type":48,"value":2370},"Least-privilege IAM",{"type":48,"value":2372}," — Use the scoped policy and trust policy in ",{"type":42,"tag":359,"props":2374,"children":2375},{"href":646},[2376],{"type":48,"value":649},{"type":48,"value":2378},"; never attach a ",{"type":42,"tag":64,"props":2380,"children":2382},{"className":2381},[],[2383],{"type":48,"value":2384},"*FullAccess",{"type":48,"value":2386}," managed policy. Scope ",{"type":42,"tag":64,"props":2388,"children":2390},{"className":2389},[],[2391],{"type":48,"value":2392},"iam:PassRole",{"type":48,"value":2394}," and ARN-pattern every mutating statement that supports resource-level permissions. (Guideline 5)",{"type":42,"tag":110,"props":2396,"children":2397},{},[2398,2403,2405,2411,2413,2417],{"type":42,"tag":270,"props":2399,"children":2400},{},[2401],{"type":48,"value":2402},"Network isolation",{"type":48,"value":2404}," — Keep instances in private subnets, restrict security groups to the application\u002Fsource SG (never ",{"type":42,"tag":64,"props":2406,"children":2408},{"className":2407},[],[2409],{"type":48,"value":2410},"0.0.0.0\u002F0",{"type":48,"value":2412},"), and use VPC endpoints for S3\u002FSSM\u002FSecrets Manager so traffic stays off the public internet. See ",{"type":42,"tag":359,"props":2414,"children":2415},{"href":668},[2416],{"type":48,"value":671},{"type":48,"value":2418},". (Guideline 5)",{"type":42,"tag":110,"props":2420,"children":2421},{},[2422,2427,2429,2433],{"type":42,"tag":270,"props":2423,"children":2424},{},[2425],{"type":48,"value":2426},"Audit logging and monitoring",{"type":48,"value":2428}," — Enable Db2 audit to S3 (",{"type":42,"tag":359,"props":2430,"children":2431},{"href":624},[2432],{"type":48,"value":627},{"type":48,"value":2434},"), RDS Enhanced Monitoring, and CloudTrail for RDS\u002FKMS\u002FSecrets Manager API calls. Alarm on failed logins and configuration changes. (Guideline 12)",{"type":42,"tag":110,"props":2436,"children":2437},{},[2438,2443,2445,2451,2453,2458],{"type":42,"tag":270,"props":2439,"children":2440},{},[2441],{"type":48,"value":2442},"Secret rotation",{"type":48,"value":2444}," — Provision with ",{"type":42,"tag":64,"props":2446,"children":2448},{"className":2447},[],[2449],{"type":48,"value":2450},"--manage-master-user-password",{"type":48,"value":2452}," so RDS stores and rotates the master password in Secrets Manager; never embed plaintext passwords. After rotation, refresh clients with ",{"type":42,"tag":64,"props":2454,"children":2456},{"className":2455},[],[2457],{"type":48,"value":1504},{"type":48,"value":2459},". (Guideline 13)",{"type":42,"tag":110,"props":2461,"children":2462},{},[2463,2468],{"type":42,"tag":270,"props":2464,"children":2465},{},[2466],{"type":48,"value":2467},"Backup encryption and retention",{"type":48,"value":2469}," — Set a backup retention period, encrypt automated and manual snapshots with your KMS key, and apply S3 bucket encryption plus lifecycle\u002Fretention to any Db2 audit or backup buckets. (Guideline 13)",{"type":42,"tag":51,"props":2471,"children":2473},{"id":2472},"additional-resources",[2474],{"type":48,"value":2475},"Additional Resources",{"type":42,"tag":94,"props":2477,"children":2479},{"id":2478},"in-scope-documentation-and-blogs",[2480],{"type":48,"value":2481},"In-scope documentation and blogs",{"type":42,"tag":106,"props":2483,"children":2484},{},[2485,2497,2508,2519,2530,2541,2552,2563,2574,2585,2596],{"type":42,"tag":110,"props":2486,"children":2487},{},[2488,2490],{"type":48,"value":2489},"AWS docs — RDS for Db2: ",{"type":42,"tag":359,"props":2491,"children":2495},{"href":2492,"rel":2493},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FCHAP_RDSDb2.html",[2494],"nofollow",[2496],{"type":48,"value":2492},{"type":42,"tag":110,"props":2498,"children":2499},{},[2500,2502],{"type":48,"value":2501},"AWS docs — RDS for Db2 IAM permissions: ",{"type":42,"tag":359,"props":2503,"children":2506},{"href":2504,"rel":2505},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FUsingWithRDS.IAM.html",[2494],[2507],{"type":48,"value":2504},{"type":42,"tag":110,"props":2509,"children":2510},{},[2511,2513],{"type":48,"value":2512},"AWS docs — Kerberos authentication for RDS for Db2: ",{"type":42,"tag":359,"props":2514,"children":2517},{"href":2515,"rel":2516},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002Fdb2-kerberos.html",[2494],[2518],{"type":48,"value":2515},{"type":42,"tag":110,"props":2520,"children":2521},{},[2522,2524],{"type":48,"value":2523},"Blog — Connect to RDS for Db2 from CloudShell: ",{"type":42,"tag":359,"props":2525,"children":2528},{"href":2526,"rel":2527},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fconnect-to-amazon-rds-for-db2-using-aws-cloudshell\u002F",[2494],[2529],{"type":48,"value":2526},{"type":42,"tag":110,"props":2531,"children":2532},{},[2533,2535],{"type":48,"value":2534},"Blog — Restore self-managed Db2 Linux into RDS for Db2: ",{"type":42,"tag":359,"props":2536,"children":2539},{"href":2537,"rel":2538},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Frestore-self-managed-db2-linux-databases-in-amazon-rds-for-db2\u002F",[2494],[2540],{"type":48,"value":2537},{"type":42,"tag":110,"props":2542,"children":2543},{},[2544,2546],{"type":48,"value":2545},"Blog — Near-zero downtime from AIX\u002FWindows to RDS for Db2 with Q Replication: ",{"type":42,"tag":359,"props":2547,"children":2550},{"href":2548,"rel":2549},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fnear-zero-downtime-migrations-from-self-managed-db2-on-aix-or-windows-to-amazon-rds-for-db2-using-ibm-q-replication\u002F",[2494],[2551],{"type":48,"value":2548},{"type":42,"tag":110,"props":2553,"children":2554},{},[2555,2557],{"type":48,"value":2556},"Blog — Cross-region standby replicas: ",{"type":42,"tag":359,"props":2558,"children":2561},{"href":2559,"rel":2560},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fconfigure-amazon-rds-for-db2-standby-replicas-for-high-availability-and-faster-disaster-recovery\u002F",[2494],[2562],{"type":48,"value":2559},{"type":42,"tag":110,"props":2564,"children":2565},{},[2566,2568],{"type":48,"value":2567},"Blog — Mainframe DDL conversion (z\u002FOS to RDS for Db2): ",{"type":42,"tag":359,"props":2569,"children":2572},{"href":2570,"rel":2571},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fmigrating-tables-from-ibm-db2-for-z-os-to-amazon-rds-for-db2\u002F",[2494],[2573],{"type":48,"value":2570},{"type":42,"tag":110,"props":2575,"children":2576},{},[2577,2579],{"type":48,"value":2578},"Blog — Code page and collation for mainframe migration: ",{"type":42,"tag":359,"props":2580,"children":2583},{"href":2581,"rel":2582},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fchoosing-the-right-code-page-and-collation-for-migration-from-mainframe-db2-to-amazon-rds-for-db2\u002F",[2494],[2584],{"type":48,"value":2581},{"type":42,"tag":110,"props":2586,"children":2587},{},[2588,2590],{"type":48,"value":2589},"Blog — Bring your own customer-managed KMS key for RDS for Db2 (DBBLOG-5188): ",{"type":42,"tag":359,"props":2591,"children":2594},{"href":2592,"rel":2593},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fbring-your-own-key-to-amazon-rds-for-db2-with-a-customer-managed-kms-key\u002F",[2494],[2595],{"type":48,"value":2592},{"type":42,"tag":110,"props":2597,"children":2598},{},[2599,2601],{"type":48,"value":2600},"Blog — Self-managed Active Directory with Kerberos for RDS for Db2: ",{"type":42,"tag":359,"props":2602,"children":2605},{"href":2603,"rel":2604},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fuse-kerberos-authentication-with-a-self-managed-active-directory-for-amazon-rds-for-db2\u002F",[2494],[2606],{"type":48,"value":2603},{"type":42,"tag":94,"props":2608,"children":2610},{"id":2609},"related-topics-cited-resources-not-yet-routed-sub-skills",[2611],{"type":48,"value":2612},"Related topics (cited resources, not yet routed sub-skills)",{"type":42,"tag":58,"props":2614,"children":2615},{},[2616],{"type":48,"value":2617},"These adjacent topics are not expanded into routed references in this iteration. Each is discoverable through the cited resource below.",{"type":42,"tag":106,"props":2619,"children":2620},{},[2621,2632,2643,2654,2665,2676,2687,2698,2709],{"type":42,"tag":110,"props":2622,"children":2623},{},[2624,2626],{"type":48,"value":2625},"Reverse log shipping for RDS for Db2 (DBBLOG-5352): ",{"type":42,"tag":359,"props":2627,"children":2630},{"href":2628,"rel":2629},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fimplement-reverse-log-shipping-for-amazon-rds-for-db2\u002F",[2494],[2631],{"type":48,"value":2628},{"type":42,"tag":110,"props":2633,"children":2634},{},[2635,2637],{"type":48,"value":2636},"Multi-account connectivity: workspace source ",{"type":42,"tag":64,"props":2638,"children":2640},{"className":2639},[],[2641],{"type":48,"value":2642},"04-db2-client\u002FRDS-Db2-Multiple-Account-Connectivity\u002F",{"type":42,"tag":110,"props":2644,"children":2645},{},[2646,2648],{"type":48,"value":2647},"Terraform provisioning: workspace source ",{"type":42,"tag":64,"props":2649,"children":2651},{"className":2650},[],[2652],{"type":48,"value":2653},"04-db2-client\u002FRDS-Db2-Terraform\u002F",{"type":42,"tag":110,"props":2655,"children":2656},{},[2657,2659],{"type":48,"value":2658},"CIS compliance: workspace source ",{"type":42,"tag":64,"props":2660,"children":2662},{"className":2661},[],[2663],{"type":48,"value":2664},"04-db2-client\u002FCIS-Compliance\u002F",{"type":42,"tag":110,"props":2666,"children":2667},{},[2668,2670],{"type":48,"value":2669},"db2mon monitoring: workspace source ",{"type":42,"tag":64,"props":2671,"children":2673},{"className":2672},[],[2674],{"type":48,"value":2675},"04-db2-client\u002Fdb2mon_RDS\u002F",{"type":42,"tag":110,"props":2677,"children":2678},{},[2679,2681],{"type":48,"value":2680},"Compression savings: workspace source ",{"type":42,"tag":64,"props":2682,"children":2684},{"className":2683},[],[2685],{"type":48,"value":2686},"04-db2-client\u002FCompression-Savings\u002F",{"type":42,"tag":110,"props":2688,"children":2689},{},[2690,2692],{"type":48,"value":2691},"Migration prerequisite check (DBBLOG-5048): ",{"type":42,"tag":359,"props":2693,"children":2696},{"href":2694,"rel":2695},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fdatabase\u002Fmigrate-from-ibm-db2-to-amazon-rds-for-db2-using-a-migration-prerequisite-check\u002F",[2494],[2697],{"type":48,"value":2694},{"type":42,"tag":110,"props":2699,"children":2700},{},[2701,2703],{"type":48,"value":2702},"Load from S3: workspace source ",{"type":42,"tag":64,"props":2704,"children":2706},{"className":2705},[],[2707],{"type":48,"value":2708},"04-db2-client\u002Fload-from-s3\u002F",{"type":42,"tag":110,"props":2710,"children":2711},{},[2712,2714],{"type":48,"value":2713},"Sample Java stored procedures: workspace source ",{"type":42,"tag":64,"props":2715,"children":2717},{"className":2716},[],[2718],{"type":48,"value":2719},"04-db2-client\u002Fsample-java-sp\u002F",{"type":42,"tag":94,"props":2721,"children":2723},{"id":2722},"blog-catalog",[2724],{"type":48,"value":2725},"Blog catalog",{"type":42,"tag":58,"props":2727,"children":2728},{},[2729,2731,2737],{"type":48,"value":2730},"The authoritative list of published RDS for Db2 blogs and sample tools is maintained at ",{"type":42,"tag":359,"props":2732,"children":2735},{"href":2733,"rel":2734},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fsample-rds-db2-tools\u002Ftree\u002Fmain",[2494],[2736],{"type":48,"value":2733},{"type":48,"value":2738}," — consult it for the current set of blog articles and companion code.",{"type":42,"tag":106,"props":2740,"children":2741},{},[2742],{"type":42,"tag":110,"props":2743,"children":2744},{},[2745,2747,2753],{"type":48,"value":2746},"Related skill (migrating off Db2 LUW to PostgreSQL): ",{"type":42,"tag":64,"props":2748,"children":2750},{"className":2749},[],[2751],{"type":48,"value":2752},"rds-postgres-migration",{"type":48,"value":2754}," (if present in corpus).",{"type":42,"tag":51,"props":2756,"children":2758},{"id":2757},"handoff-from-aws-database-selection",[2759],{"type":48,"value":2760},"Handoff from aws-database-selection",{"type":42,"tag":58,"props":2762,"children":2763},{},[2764,2766,2772,2774,2780,2782,2788,2790,2796],{"type":48,"value":2765},"This skill can be invoked directly, or it can be entered from the ",{"type":42,"tag":64,"props":2767,"children":2769},{"className":2768},[],[2770],{"type":48,"value":2771},"aws-database-selection",{"type":48,"value":2773}," parent skill after that skill has run a requirements interview and produced a ",{"type":42,"tag":64,"props":2775,"children":2777},{"className":2776},[],[2778],{"type":48,"value":2779},"requirements.json",{"type":48,"value":2781}," artifact. When you see a backtick-wrapped path matching ",{"type":42,"tag":64,"props":2783,"children":2785},{"className":2784},[],[2786],{"type":48,"value":2787},"aws_dbs_requirements\u002F*\u002Frequirements.json",{"type":48,"value":2789}," in recent conversation, follow the entry protocol in ",{"type":42,"tag":64,"props":2791,"children":2793},{"className":2792},[],[2794],{"type":48,"value":2795},"aws-database-selection\u002Freferences\u002Fhandoff-contract.md",{"type":48,"value":2797},":",{"type":42,"tag":1060,"props":2799,"children":2800},{},[2801,2813,2826,2838,2873],{"type":42,"tag":110,"props":2802,"children":2803},{},[2804,2806,2812],{"type":48,"value":2805},"Read the artifact using ",{"type":42,"tag":64,"props":2807,"children":2809},{"className":2808},[],[2810],{"type":48,"value":2811},"file_read",{"type":48,"value":1186},{"type":42,"tag":110,"props":2814,"children":2815},{},[2816,2818,2824],{"type":48,"value":2817},"Validate it against ",{"type":42,"tag":64,"props":2819,"children":2821},{"className":2820},[],[2822],{"type":48,"value":2823},"aws-database-selection\u002Freferences\u002Fworkload-primary-artifact.schema.json",{"type":48,"value":2825},". If malformed or unreadable, tell the user and proceed without it.",{"type":42,"tag":110,"props":2827,"children":2828},{},[2829,2831,2836],{"type":48,"value":2830},"Acknowledge what's relevant in one or two ",{"type":42,"tag":270,"props":2832,"children":2833},{},[2834],{"type":48,"value":2835},"bold",{"type":48,"value":2837}," sentences, citing high-level facts from the artifact (dominant shapes, hard constraints, migration context) — do not parrot the entire artifact back.",{"type":42,"tag":110,"props":2839,"children":2840},{},[2841,2843,2849,2850,2856,2858,2864,2866,2871],{"type":48,"value":2842},"Scope-check: this skill is scoped to Amazon RDS for Db2 — migrations from Db2 z\u002FOS or LUW, HADR, standby replicas, SQL PL routines, Q Replication cutovers. If the artifact's ",{"type":42,"tag":64,"props":2844,"children":2846},{"className":2845},[],[2847],{"type":48,"value":2848},"workload_primaries.dominant_shapes",{"type":48,"value":904},{"type":42,"tag":64,"props":2851,"children":2853},{"className":2852},[],[2854],{"type":48,"value":2855},"migration_context",{"type":48,"value":2857}," don't match that scope, emit weak backpressure per the handoff contract: suggest ",{"type":42,"tag":64,"props":2859,"children":2861},{"className":2860},[],[2862],{"type":48,"value":2863},"amazon-aurora",{"type":48,"value":2865}," for refactor-to-PostgreSQL from Db2, or go back to ",{"type":42,"tag":64,"props":2867,"children":2869},{"className":2868},[],[2870],{"type":48,"value":2771},{"type":48,"value":2872}," if Db2 isn't the source, then ask the user whether to go back or proceed anyway. Do not silently misuse the artifact.",{"type":42,"tag":110,"props":2874,"children":2875},{},[2876],{"type":48,"value":2877},"Proceed with this skill's native workflow, citing artifact paths as evidence when recommendations are grounded in the requirements.",{"type":42,"tag":58,"props":2879,"children":2880},{},[2881,2883,2888,2890,2896,2898,2904],{"type":48,"value":2882},"The curated RDS-for-Db2 selection facts that the parent ",{"type":42,"tag":64,"props":2884,"children":2886},{"className":2885},[],[2887],{"type":48,"value":2771},{"type":48,"value":2889}," skill consumes live at ",{"type":42,"tag":64,"props":2891,"children":2893},{"className":2892},[],[2894],{"type":48,"value":2895},"assets\u002Fselection-knowledge-input.json",{"type":48,"value":2897}," (with a human-readable companion at ",{"type":42,"tag":64,"props":2899,"children":2901},{"className":2900},[],[2902],{"type":48,"value":2903},"assets\u002Fselection-knowledge-input.md",{"type":48,"value":2905},"). These capture the in-scope source-migration scenarios, hard constraints, HA\u002FDR options, and security areas in a structured, reusable form — read them when you need the curated selection view rather than re-deriving it.",{"type":42,"tag":58,"props":2907,"children":2908},{},[2909],{"type":48,"value":2910},"All user-facing output from this skill follows the markdown-primitives-only formatting convention in the handoff contract: bold labels, backticks for paths and enum values, bullet lists for alternatives, no ASCII art or box-drawing characters.",{"items":2912,"total":3016},[2913,2930,2945,2960,2975,2985,3000],{"slug":2914,"name":2914,"fn":2915,"description":2916,"org":2917,"tags":2918,"stars":24,"repoUrl":25,"updatedAt":2929},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2919,2922,2925,2926],{"name":2920,"slug":2921,"type":15},"Agents","agents",{"name":2923,"slug":2924,"type":15},"Automation","automation",{"name":23,"slug":8,"type":15},{"name":2927,"slug":2928,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":2931,"name":2931,"fn":2932,"description":2933,"org":2934,"tags":2935,"stars":24,"repoUrl":25,"updatedAt":2944},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2936,2937,2940,2943],{"name":2920,"slug":2921,"type":15},{"name":2938,"slug":2939,"type":15},"API Development","api-development",{"name":2941,"slug":2942,"type":15},"Authentication","authentication",{"name":23,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":2946,"name":2946,"fn":2947,"description":2948,"org":2949,"tags":2950,"stars":24,"repoUrl":25,"updatedAt":2959},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2951,2952,2953,2956],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2954,"slug":2955,"type":15},"Debugging","debugging",{"name":2957,"slug":2958,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":2961,"name":2961,"fn":2962,"description":2963,"org":2964,"tags":2965,"stars":24,"repoUrl":25,"updatedAt":2974},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2966,2967,2968,2971],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2969,"slug":2970,"type":15},"CI\u002FCD","ci-cd",{"name":2972,"slug":2973,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":2976,"name":2976,"fn":2977,"description":2978,"org":2979,"tags":2980,"stars":24,"repoUrl":25,"updatedAt":2984},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2981,2982,2983],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2972,"slug":2973,"type":15},"2026-07-12T08:42:51.963247",{"slug":2986,"name":2986,"fn":2987,"description":2988,"org":2989,"tags":2990,"stars":24,"repoUrl":25,"updatedAt":2999},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2991,2992,2993,2996],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2994,"slug":2995,"type":15},"Best Practices","best-practices",{"name":2997,"slug":2998,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":3001,"name":3001,"fn":3002,"description":3003,"org":3004,"tags":3005,"stars":24,"repoUrl":25,"updatedAt":3015},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3006,3007,3008,3011,3012],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":3009,"slug":3010,"type":15},"Evals","evals",{"name":2957,"slug":2958,"type":15},{"name":3013,"slug":3014,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",114,{"items":3018,"total":3133},[3019,3026,3033,3040,3047,3053,3060,3068,3083,3096,3108,3123],{"slug":2914,"name":2914,"fn":2915,"description":2916,"org":3020,"tags":3021,"stars":24,"repoUrl":25,"updatedAt":2929},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3022,3023,3024,3025],{"name":2920,"slug":2921,"type":15},{"name":2923,"slug":2924,"type":15},{"name":23,"slug":8,"type":15},{"name":2927,"slug":2928,"type":15},{"slug":2931,"name":2931,"fn":2932,"description":2933,"org":3027,"tags":3028,"stars":24,"repoUrl":25,"updatedAt":2944},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3029,3030,3031,3032],{"name":2920,"slug":2921,"type":15},{"name":2938,"slug":2939,"type":15},{"name":2941,"slug":2942,"type":15},{"name":23,"slug":8,"type":15},{"slug":2946,"name":2946,"fn":2947,"description":2948,"org":3034,"tags":3035,"stars":24,"repoUrl":25,"updatedAt":2959},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3036,3037,3038,3039],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2954,"slug":2955,"type":15},{"name":2957,"slug":2958,"type":15},{"slug":2961,"name":2961,"fn":2962,"description":2963,"org":3041,"tags":3042,"stars":24,"repoUrl":25,"updatedAt":2974},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3043,3044,3045,3046],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2969,"slug":2970,"type":15},{"name":2972,"slug":2973,"type":15},{"slug":2976,"name":2976,"fn":2977,"description":2978,"org":3048,"tags":3049,"stars":24,"repoUrl":25,"updatedAt":2984},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3050,3051,3052],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2972,"slug":2973,"type":15},{"slug":2986,"name":2986,"fn":2987,"description":2988,"org":3054,"tags":3055,"stars":24,"repoUrl":25,"updatedAt":2999},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3056,3057,3058,3059],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":2994,"slug":2995,"type":15},{"name":2997,"slug":2998,"type":15},{"slug":3001,"name":3001,"fn":3002,"description":3003,"org":3061,"tags":3062,"stars":24,"repoUrl":25,"updatedAt":3015},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3063,3064,3065,3066,3067],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":3009,"slug":3010,"type":15},{"name":2957,"slug":2958,"type":15},{"name":3013,"slug":3014,"type":15},{"slug":3069,"name":3069,"fn":3070,"description":3071,"org":3072,"tags":3073,"stars":24,"repoUrl":25,"updatedAt":3082},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3074,3075,3076,3079],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":3077,"slug":3078,"type":15},"MySQL","mysql",{"name":3080,"slug":3081,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":3084,"name":3084,"fn":3085,"description":3086,"org":3087,"tags":3088,"stars":24,"repoUrl":25,"updatedAt":3095},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3089,3090,3091,3094],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":3092,"slug":3093,"type":15},"PostgreSQL","postgresql",{"name":3080,"slug":3081,"type":15},"2026-07-16T06:00:34.789624",{"slug":3097,"name":3097,"fn":3098,"description":3099,"org":3100,"tags":3101,"stars":24,"repoUrl":25,"updatedAt":3107},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3102,3103,3104],{"name":2920,"slug":2921,"type":15},{"name":23,"slug":8,"type":15},{"name":3105,"slug":3106,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":3109,"name":3109,"fn":3110,"description":3111,"org":3112,"tags":3113,"stars":24,"repoUrl":25,"updatedAt":3122},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3114,3115,3116,3119],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":3117,"slug":3118,"type":15},"MongoDB","mongodb",{"name":3120,"slug":3121,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":3124,"name":3124,"fn":3125,"description":3126,"org":3127,"tags":3128,"stars":24,"repoUrl":25,"updatedAt":3132},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3129,3130,3131],{"name":23,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":3120,"slug":3121,"type":15},"2026-07-16T06:00:37.690386",115]