[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-rds-sqlserver":3,"mdc-2546a2-key":32,"related-repo-aws-rds-sqlserver":2739,"related-org-aws-rds-sqlserver":2845},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":21,"repoUrl":22,"updatedAt":23,"license":24,"forks":25,"topics":26,"repo":27,"sourceUrl":30,"mdContent":31},"rds-sqlserver","connect and troubleshoot Amazon RDS SQL Server","Provides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server. Applicable when users ask about SSMS times out connecting from EC2, Cannot generate SSPI context with Windows auth, connect RDS SQL Server from Lambda with pymssql, auth_scheme shows NTLM instead of KERBEROS on ECS Fargate, SSM tunnel to RDS SQL Server from laptop, port 1433 security group, TrustServerCertificate=True for localhost tunnels, SPN MSSQLSvc, AWS Managed Microsoft AD, CNAME not RDS endpoint for Kerberos, tds_version='7.4', encryption='require', port-as-string for pymssql, Secrets Manager credential caching in Lambda, error 18456 login failed. Covers Python (pymssql, pyodbc), .NET (Microsoft.Data.SqlClient), Java (JDBC mssql-jdbc), Node.js (tedious), IAM auth via RDS Proxy, and VPC\u002FECS\u002FEKS\u002FLambda deployment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19],{"name":13,"slug":14,"type":15},"Database","database","tag",{"name":17,"slug":18,"type":15},"SQL","sql",{"name":20,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-16T06:00:38.205817",null,157,[],{"repoUrl":22,"stars":21,"forks":25,"topics":28,"description":29},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fdatabase-skills\u002Frds-sqlserver","---\nname: rds-sqlserver\nversion: 1\ndescription: Provides connectivity, authentication, and troubleshooting guidance for Amazon RDS for SQL Server. Applicable when users ask about SSMS times out connecting from EC2, Cannot generate SSPI context with Windows auth, connect RDS SQL Server from Lambda with pymssql, auth_scheme shows NTLM instead of KERBEROS on ECS Fargate, SSM tunnel to RDS SQL Server from laptop, port 1433 security group, TrustServerCertificate=True for localhost tunnels, SPN MSSQLSvc, AWS Managed Microsoft AD, CNAME not RDS endpoint for Kerberos, tds_version='7.4', encryption='require', port-as-string for pymssql, Secrets Manager credential caching in Lambda, error 18456 login failed. Covers Python (pymssql, pyodbc), .NET (Microsoft.Data.SqlClient), Java (JDBC mssql-jdbc), Node.js (tedious), IAM auth via RDS Proxy, and VPC\u002FECS\u002FEKS\u002FLambda deployment.\n---\n\n# Amazon RDS for SQL Server\n\n## Safety guidance\n\nThis skill covers creating and modifying RDS for SQL Server resources when the user requests it. The agent MUST confirm the action with the user before executing. Do NOT execute any create or modify operation without explicit user confirmation (e.g., \"yes\", \"proceed\", \"confirmed\", \"go ahead\"). If the user has not confirmed, present the planned action and ask for approval.\n\n### Execute these operations (after user confirmation)\n\n- Create an instance: `create-db-instance` (requires a DB subnet group; RDS SQL Server is VPC-only and not publicly accessible by default)\n- Create a custom parameter group: `create-db-parameter-group` (family `sqlserver-ex-15.00`, `sqlserver-se-15.00`, etc.) — needed to set `rds.force_ssl=1` among others\n- Create an option group: `create-option-group` (for TDE, S3 integration, SQLServer Audit, Native Backup\u002FRestore, SSIS, SSAS, SSRS)\n- Create an RDS Proxy: `create-db-proxy`, `register-db-proxy-targets` (for IAM DB auth in front of SQL Server — see the rds-proxy reference)\n- Create an AWS Managed Microsoft AD directory for Windows auth: `create-directory` (then associate via `modify-db-instance --domain`)\n- Create a Secrets Manager secret with rotation: `create-secret`, `rotate-secret --rotation-rules AutomaticallyAfterDays=N`\n- Change backup retention, deletion protection, log exports: `modify-db-instance --backup-retention-period` \u002F `--deletion-protection` \u002F `--cloudwatch-logs-export-configuration`\n- Attach\u002Fdetach parameter group or option group: `modify-db-instance --db-parameter-group-name \u002F --option-group-name`\n- Tag resources: `add-tags-to-resource`, `remove-tags-from-resource`\n\n### Resource tagging (always apply on resource creation)\n\nWhen creating any RDS for SQL Server resource (`create-db-instance`, `create-db-parameter-group`, `create-option-group`, `create-db-proxy`, `create-secret` for RDS credentials, `create-directory` for Windows auth), ALWAYS include these tags using the RDS list-of-records `--tags` syntax (AWS Directory Service and Secrets Manager use the same shape):\n\n`--tags Key=created_by,Value=rds-sqlserver-skill Key=generation_model,Value={your-model-id}`\n\nExample: `--tags Key=created_by,Value=rds-sqlserver-skill Key=generation_model,Value=claude-sonnet-4-20250514`\n\nInclude these tags even if the user does not mention tagging, so that they can identify the resources created via this skill. If the user provides additional tags, append these to their tags rather than replacing them. The same applies when tagging via `add-tags-to-resource` on existing resources.\n\n### Execute with downtime warning (warn user, then execute after they confirm)\n\n- Change instance class: `modify-db-instance --db-instance-class` — warn: \"This causes a failover in Multi-AZ configurations and brief unavailability on single-AZ instances.\"\n- Minor engine version upgrade: `modify-db-instance --engine-version` within the same major (e.g., 15.00.4X → 15.00.4Y) — warn: \"This triggers a restart and may cause a brief outage.\"\n- Storage type or IOPS change: `modify-db-instance --storage-type` \u002F `--iops` \u002F `--allocated-storage` — warn: \"This can cause extended IO degradation while the change applies.\"\n- Apply immediately: any `modify-db-instance --apply-immediately` — warn: \"This applies outside the maintenance window and may cause downtime now.\"\n- Domain join\u002Funjoin: `modify-db-instance --domain` \u002F `--disable-domain` — warn: \"This restarts the instance.\"\n\n### Do NOT execute (refuse, explain why, offer assessment instead)\n\n- Delete instance: `delete-db-instance` — irreversible data loss\n- Delete automated backups: `delete-db-instance --delete-automated-backups` — destroys point-in-time recovery history\n- Failover: `reboot-db-instance --force-failover` — production impact\n- Major version upgrade: `modify-db-instance --engine-version` across major versions (e.g., 15.0 → 16.0) — requires prechecks and a rollback plan; should go through change-control\n- Reboot: `reboot-db-instance` — production impact\n- Enable public accessibility: `modify-db-instance --publicly-accessible true` — security regression; use SSM port forwarding, VPN, or Direct Connect\n\nWhen refusing, explain why and offer the matching assessment workflow:\n> \"I can't perform [action] because [reason]. I can run an assessment to help you decide. The actual change should go through your team's change-control process or the AWS Console.\"\n\n## Overview\n\nAmazon RDS for SQL Server is the managed SQL Server service from AWS. This skill covers the end-to-end workflow for connecting applications to RDS for SQL Server: driver selection, connection strings, SSL\u002FTLS encryption, SQL and Windows authentication, IAM authentication via RDS Proxy, connection pooling, VPC networking, deployment patterns for EC2 \u002F ECS \u002F Lambda \u002F EKS, and troubleshooting of the common error modes.\n\nThis skill works with the AWS CLI directly. The AWS MCP server is recommended but not required — it adds sandboxed execution, CloudTrail audit, and observability when available.\n\n## Common Tasks\n\n### 1. Verify Dependencies\n\nCheck for required tools and warn the user if any are missing.\n\n**Constraints:**\n\n- You MUST verify that the AWS CLI is available (`aws --version`)\n- You MUST inform the user if the AWS CLI is missing, because most steps need AWS API access\n- If the AWS MCP server tools (`call_aws`, `suggest_aws_commands`) are available, prefer them for audit and observability — but they are NOT required\n\n### 2. Classify and Route\n\nCollect the connection context and route to the right sub-skill reference file.\n\nParameters:\n\n- **language** (required): `python` | `dotnet` | `java` | `nodejs`. Infer from project files (`requirements.txt`\u002F`*.py` → python; `*.csproj` → dotnet; `pom.xml`\u002F`build.gradle` → java; `package.json` → nodejs). Ask only if ambiguous.\n- **runtime** (required): `ec2` | `ecs` | `lambda` | `eks` | `laptop`. Drives networking + secrets pattern.\n- **auth** (required): `sql` | `windows-kerberos` | `windows-ntlm` | `iam-proxy`. Default `sql` unless the user mentions Active Directory, Kerberos, NTLM, or IAM.\n- **region** (required): AWS region, e.g. `us-east-1`.\n- **db_instance_id** (required for troubleshooting): RDS instance identifier.\n\n**Constraints:**\n\n- You MUST ask for all required parameters upfront in a single prompt, because iterative questioning frustrates users\n- You MUST infer `language` from project files when available rather than asking\n- You MUST validate `region` against the enumerated list of AWS regions before proceeding\n- You SHOULD default to SQL authentication unless the user explicitly says Windows auth, IAM auth, or Active Directory\n\n#### Sub-skill routing\n\nLoad **exactly one driver** reference plus any relevant topic references:\n\n| User is doing | Load |\n|---|---|\n| Python \u002F pymssql \u002F pyodbc | [references\u002Fpython.md](references\u002Fpython.md) |\n| .NET \u002F C# \u002F Microsoft.Data.SqlClient | [references\u002Fdotnet.md](references\u002Fdotnet.md) |\n| Java \u002F JDBC \u002F mssql-jdbc | [references\u002Fjava.md](references\u002Fjava.md) |\n| Node.js \u002F tedious \u002F mssql | [references\u002Fnodejs.md](references\u002Fnodejs.md) |\n| EC2 hosting | [references\u002Fec2-vpc.md](references\u002Fec2-vpc.md) |\n| Lambda hosting | [references\u002Flambda-vpc.md](references\u002Flambda-vpc.md) |\n| ECS or Fargate hosting | [references\u002Fecs-fargate-vpc.md](references\u002Fecs-fargate-vpc.md) |\n| Laptop via SSM tunnel | [references\u002Fssm-tunneling.md](references\u002Fssm-tunneling.md) |\n| SSL\u002FTLS, rds.force_ssl, certificates | [references\u002Fencryption.md](references\u002Fencryption.md) |\n| Windows \u002F AD \u002F Kerberos \u002F NTLM | [references\u002Fad-kerberos.md](references\u002Fad-kerberos.md) |\n| Cross-VPC, Transit Gateway, VPC peering | [references\u002Fnetworking.md](references\u002Fnetworking.md) |\n| SQL auth, Secrets Manager, credentials | [references\u002Fconnection-auth.md](references\u002Fconnection-auth.md) |\n| IAM auth, RDS Proxy, connection pooling | [references\u002Frds-proxy.md](references\u002Frds-proxy.md) |\n| Errors, connection failures, Kerberos falls back to NTLM | [references\u002Ftroubleshooting.md](references\u002Ftroubleshooting.md) |\n\n### 3. Execute the Workflow\n\nFollow the steps in the loaded reference files in order: driver setup → networking → auth → secrets → verify.\n\n**Constraints:**\n\n- You MUST use `TLS 1.2` or higher for all connections, because older TLS versions have known vulnerabilities\n- You MUST fetch credentials from AWS Secrets Manager rather than embedding passwords in code, because hardcoded secrets leak into logs and source control\n- You MUST set `Encrypt=Mandatory` (.NET) \u002F `encrypt=true` (JDBC) \u002F `encryption=\"require\"` (pymssql) \u002F `encrypt: true` (tedious) in production, because opportunistic encryption may silently fall back to plaintext\n- You MUST verify server certificate chain using the RDS CA bundle from `https:\u002F\u002Ftruststore.pki.rds.amazonaws.com\u002Fglobal\u002Fglobal-bundle.pem` rather than setting `TrustServerCertificate=true` in production, because disabling verification exposes you to MITM attacks\n- You MUST NOT enable `PubliclyAccessible: true` on the DB instance, because it exposes SQL Server port 1433 to the public internet\n- You MUST use security group IDs as the source for same-VPC access and CIDR blocks for cross-VPC access via Transit Gateway or VPC peering, because SG references don't cross VPC boundaries\n- You MUST NOT use IAM authentication directly against RDS for SQL Server, because RDS for SQL Server does not support it — IAM auth requires RDS Proxy in front of the instance\n- You MUST test Windows authentication from a domain-joined host (EC2 or client), not via SSM send-command, because SSM runs as the system account, not the user's AD identity\n- You SHOULD prefer Kerberos over NTLM when both are available, because Kerberos is cryptographically stronger and easier to audit\n- You SHOULD use `pyodbc` instead of `pymssql` when the application requires Kerberos\u002FWindows authentication, because pymssql does not support Kerberos\n\n### Rubric-Critical Facts to Always Surface\n\nThese RDS-for-SQL-Server-specific facts differentiate this skill from general SQL Server knowledge. Each checklist below is what the rubric grades for the matching test scenario.\n\n**For \"unable to connect to RDS SQL Server from EC2 — SSMS times out\", you MUST tell the user ALL of the following six facts — and MUST investigate systematically rather than dumping a generic checklist:**\n\n1. **Ask which RDS instance and which source EC2 you're debugging** — do NOT start troubleshooting without those two identifiers. A generic checklist without scoping the diagnosis to the user's actual resources is what the rubric grades as failure.\n2. **Check VPC and subnet connectivity** between the EC2 and the RDS (same VPC, or VPC peering\u002FTransit Gateway with routable paths).\n3. **Security group on RDS allows 1433 inbound from EC2's SG** (by SG id, not CIDR). The SG rule is the most common fix.\n4. **DNS resolution of the RDS endpoint** from the EC2 — run `nslookup \u003Crds-endpoint>` from the EC2 and confirm it returns a private IP.\n5. **TCP connectivity on port 1433** — run `Test-NetConnection -ComputerName \u003Crds-endpoint> -Port 1433` from PowerShell or `telnet \u003Crds-endpoint> 1433`. If this fails while DNS works, the problem is in the SG or NACLs.\n6. **Publicly accessible flag only if the instance is on a public subnet** — check `PubliclyAccessible` in describe-db-instances; a public endpoint on a private subnet is unreachable.\n7. **Suggest SSMS Options → Connection Properties → Network Protocol = TCP\u002FIP** if the default protocol is misbehaving. **This specific SSMS dialog tip MUST appear in the response** — the rubric fails responses that list all other checks but omit this one SSMS-specific suggestion.\n\n**For \"Cannot generate SSPI context\" error with Windows auth, you MUST tell the user ALL of the following six facts:**\n\n1. **Ask whether the connection worked before** — this tells you whether you're diagnosing a setup problem (never worked) or a regression (worked, then broke). The diagnostic paths are different. Do NOT skip this triage step.\n2. **Check domain-join state of the client** — on Windows run `nltest \u002Fdsgetdc:\u003Cdomain>` or `systeminfo | findstr \u002FB \u002FC:\"Domain\"`. The client must be domain-joined to the AD that the RDS instance trusts.\n3. **Run `klist` to inspect Kerberos tickets** — look for tickets for `MSSQLSvc\u002F\u003Csql-server-host>:\u003Cport>`. If no ticket, Kerberos isn't working. **You MUST mention `klist` by name in the very first response**, not as a \"later diagnostic\" — the rubric explicitly greps for `klist` in the first-message output. Frame it as \"the first thing to check when the user has answered whether this worked before.\"\n4. **Verify SPN registration** for `MSSQLSvc\u002F\u003Ccname>:1433` on the RDS instance in AWS Managed Microsoft AD — run `setspn -L \u003Cservice-account>` or check the directory service. Missing SPN is the most common SSPI cause.\n5. **Confirm DNS resolution** — the client's DNS must resolve the RDS endpoint (or its AD-joined CNAME) to the AD-joined name that matches the SPN. Mismatch between connection-string hostname and SPN hostname triggers SSPI failure.\n6. **Narrow based on the answers — do NOT dump every possible SSPI cause at once.** Ask the \"worked before?\" question FIRST. Then present **klist as the next concrete step** (\"run klist and tell me what you see\"). Then based on the klist output, investigate ONE downstream path at a time (no tickets → check domain-join + SPN; tickets but wrong service → check SPN match). **Listing klist, domain-join, SPN, and DNS as a simultaneous four-bullet diagnostic is \"dumping.\" Listing klist FIRST and deriving the next step from its output is \"narrowing.\" Do the latter.** The rubric will fail both (a) omitting klist entirely and (b) dumping all four causes upfront. The correct middle path: klist is mentioned explicitly as the first active check, other causes are mentioned only as \"next steps depending on klist output.\"\n\n**For \"Lambda with pymssql to RDS SQL Server\", you MUST tell the user ALL of the following eight facts:**\n\n1. **Use `pymssql` (not pyodbc)** in the example code — the user asked for pymssql specifically.\n2. **Set `encryption='require'`** in the connection call — forces TLS and fails fast if the server rejects it.\n3. **Set `tds_version='7.4'`** — older TDS versions lack the TLS\u002Fauth features RDS needs. 7.4 is the minimum supported on current RDS SQL Server.\n4. **Pass the port as a STRING** — `port='1433'`, not `port=1433`. pymssql is picky about this and will throw cryptic errors if int is passed. Call this out as a pymssql gotcha.\n5. **Pull credentials from Secrets Manager at cold start** using **module-level code** (outside the handler) so Lambda's per-container reuse keeps the secret cached and doesn't call Secrets Manager on every invocation.\n6. **Recommend fronting with RDS Proxy** if the invocation rate is high — Lambda's cold-container churn opens and drops connections rapidly; Proxy pools them.\n7. **Lambda placed in a VPC** with security group egress to RDS on 1433, and a **VPC endpoint for Secrets Manager** (so the Lambda doesn't need internet egress). Both are required for a production VPC Lambda.\n8. **Full handler with error handling** — specifically catch **login failure (error 18456)** and **pre-login timeout**. **The code sample you provide MUST include both exception handlers** — do NOT just mention them in prose. Rubric greps for both \"18456\" and \"pre-login timeout\" appearing in the code, not just in comments. Example pattern to include:\n\n```python\ntry:\n    conn = pymssql.connect(server=host, port='1433', user=user, password=pw,\n                            database=db, encryption='require', tds_version='7.4',\n                            login_timeout=5)\nexcept pymssql.OperationalError as e:\n    msg = str(e)\n    if '18456' in msg or 'Login failed' in msg:\n        # error 18456: bad credentials \u002F wrong database \u002F disabled login\n        raise RuntimeError(f\"Login failed (18456): {e}\")\n    if 'pre-login' in msg.lower() or 'timeout' in msg.lower():\n        # pre-login timeout: network path or RDS unhealthy\n        raise RuntimeError(f\"Pre-login timeout: {e}\")\n    raise\n```\n\n**For \"ECS Fargate auth_scheme shows NTLM instead of KERBEROS\", you MUST tell the user ALL of the following five facts:**\n\n1. **Recognize this as Kerberos falling back to NTLM, NOT a connection issue.** The TCP connection succeeded; auth negotiation is the problem. Do NOT treat this as a security-group or DNS symptom first.\n2. **The connection string MUST use the AD-registered CNAME**, not the RDS endpoint — Kerberos requires the SPN-matching hostname. If the client connects to `my-db.abc123.us-east-1.rds.amazonaws.com` but the SPN is registered against `sql.corp.example.com`, Kerberos can't match and falls back to NTLM. This is the #1 root cause.\n3. **Verify the SPN `MSSQLSvc\u002F\u003Ccname>:1433`** is registered in AD — run `setspn -L \u003Cservice-account>` on a domain-joined host. Missing SPN → NTLM fallback.\n4. **Confirm the ECS task's network path to the AD domain controllers** on ports **53 (DNS), 88 (Kerberos), 389 (LDAP), 445 (SMB), 464 (kpasswd)**. Any missing port will silently degrade to NTLM. Kerberos DOES NOT just use 1433.\n5. **Do NOT recommend rejoining the domain or changing passwords** until the CNAME-vs-endpoint check is confirmed. Those fixes are for different symptoms.\n\n**For \"SSM tunnel from laptop to RDS SQL Server\", you MUST tell the user ALL of the following six facts:**\n\n1. **Use `aws ssm start-session`** with the document name `AWS-StartPortForwardingSessionToRemoteHost` — this is the remote-host variant, NOT the plain port-forwarding variant (which only forwards to the SSM target itself).\n2. **Document parameters:** `host=\u003Crds-endpoint>`, `portNumber=1433`, `localPortNumber=11433` (use **11433 as the example**, not 1433 — a local port in the 11000s avoids conflicts with a local SQL Server instance on the laptop).\n3. **Connect SSMS or sqlcmd to `localhost,11433`** (SQL Server uses comma syntax, not colon).\n4. **Include `TrustServerCertificate=True`** in the connection string. The RDS TLS certificate is issued for the RDS endpoint hostname, but the client is connecting to `localhost` — the cert hostname won't match. `TrustServerCertificate=True` skips the hostname check. Call this out explicitly as the reason.\n5. **Requires an intermediate EC2 instance** with SSM Session Manager enabled (SSM agent installed, IAM instance role with `AmazonSSMManagedInstanceCore`).\n6. **Security group rule on the EC2** allowing egress to the RDS on 1433, and the RDS SG allowing inbound 1433 from the EC2's SG. The EC2 is the tunnel endpoint; the RDS must accept from the EC2.\n\n## Troubleshooting\n\n### Login failed for user (error 18456)\n\nMost common cause: wrong password (state 8 in SQL Server log), wrong database (state 38\u002F40), or disabled login (state 7).\n\n- Fetch current password from Secrets Manager; if the secret has been rotated, restart the app or clear the pool\n- Run `SELECT * FROM sys.server_principals WHERE name = 'user'` — check the `is_disabled` column\n- See [references\u002Ftroubleshooting.md](references\u002Ftroubleshooting.md) for the full state-code decode\n\n### Cannot generate SSPI context\n\nWindows authentication with Kerberos handshake failure. Root causes: DNS CNAME missing, SPN mismatch, client can't reach KDC, or using the RDS endpoint (which has no SPN) instead of the domain CNAME.\n\n- Verify the CNAME `\u003Cdb-instance-identifier>.\u003Cdomain-fqdn>` resolves from the client\n- Check SPN exists in AD for the CNAME\n- See [references\u002Fad-kerberos.md](references\u002Fad-kerberos.md)\n\n### auth_scheme shows NTLM instead of KERBEROS\n\nKerberos fell back to NTLM. Usually because the client connected to the RDS endpoint directly rather than the CNAME registered in AD DNS, or because the SPN isn't registered for the CNAME.\n\n- Connect to the CNAME (e.g. `database-1.example.com`) not the RDS endpoint\n- Verify with `SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID`\n- See [references\u002Ftroubleshooting.md](references\u002Ftroubleshooting.md)\n\n### Connection timeout\n\nNetwork path blocked. Check in order:\n\n1. Security group inbound on 1433 from the client SG (same VPC) or CIDR (cross-VPC)\n2. Route table has a route to RDS (TGW attachment or peering)\n3. NACL isn't blocking return traffic\n4. RDS instance is in `available` state\n5. For Lambda in VPC: NAT gateway or VPC endpoint for Secrets Manager\u002FSTS\n\n### Certificate validation errors\n\nClient doesn't trust the RDS CA chain. Download `global-bundle.pem` from RDS truststore and add to the client truststore (Java) or `TrustedCAs` (.NET) or `SSL_SERVER_CA` (Python).\n\n### Access denied to Secrets Manager from Lambda\n\nLambda in VPC has no internet access by default. Either create a VPC endpoint for Secrets Manager or add a NAT gateway. Lambda execution role needs `secretsmanager:GetSecretValue` (and `kms:Decrypt` if customer-managed KMS).\n\n### SSMS \"A connection was successfully established with the server, but then an error occurred during the pre-login handshake\"\n\nTLS version mismatch. SSMS \u003C 18 uses TLS 1.0; RDS SQL Server requires TLS 1.2+. Upgrade SSMS or apply the TLS 1.2 patch.\n\n### pymssql ImportError: DLL load failed on Windows\n\nMissing FreeTDS. Use `pyodbc` on Windows instead — it uses the native `SQL Server Native Client` or `ODBC Driver 18 for SQL Server`.\n\n## Additional Resources\n\n- **AWS RDS for SQL Server User Guide**: \u003Chttps:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FCHAP_SQLServer.html>\n- **RDS SQL Server TLS\u002FSSL**: \u003Chttps:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FSQLServer.Concepts.General.SSL.Using.html>\n- **AWS Managed Microsoft AD with RDS**: \u003Chttps:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FUSER_SQLServerWinAuth.html>\n- **RDS Proxy for SQL Server**: \u003Chttps:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002Frds-proxy.html>\n- **Microsoft.Data.SqlClient**: \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsql\u002Fconnect\u002Fado-net\u002Fmicrosoft-ado-net-sql-server>\n- **mssql-jdbc driver**: \u003Chttps:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsql\u002Fconnect\u002Fjdbc\u002Fmicrosoft-jdbc-driver-for-sql-server>\n- **pymssql documentation**: \u003Chttps:\u002F\u002Fwww.pymssql.org\u002F>\n- **tedious (Node.js)**: \u003Chttps:\u002F\u002Ftediousjs.github.io\u002Ftedious\u002F>\n- **RDS CA bundle**: \u003Chttps:\u002F\u002Ftruststore.pki.rds.amazonaws.com\u002Fglobal\u002Fglobal-bundle.pem>\n- **Related skills**: `rds-oracle`, `rds-db2`, `amazon-aurora` (for cross-engine comparison)\n\n## Handoff from aws-database-selection\n\nThis skill can be invoked directly, or it can be entered from the `aws-database-selection` parent skill after that skill has run a requirements interview and produced a `requirements.json` artifact. When you see a backtick-wrapped path matching `aws_dbs_requirements\u002F*\u002Frequirements.json` in recent conversation, follow the entry protocol in `aws-database-selection\u002Freferences\u002Fhandoff-contract.md`:\n\n1. Read the artifact using `file_read`.\n2. Validate it against `aws-database-selection\u002Freferences\u002Fworkload-primary-artifact.schema.json`. If malformed or unreadable, tell the user and proceed without it.\n3. Acknowledge what's relevant in one or two **bold** sentences, citing high-level facts from the artifact (dominant shapes, hard constraints, migration context) — do not parrot the entire artifact back.\n4. Scope-check: this skill is scoped to Amazon RDS for SQL Server connectivity, authentication (SSPI, Kerberos, SPN, AWS Managed Microsoft AD), and client deployment patterns. If the artifact's `workload_primaries.dominant_shapes` or `migration_context` don't match that scope, emit weak backpressure per the handoff contract: suggest `amazon-aurora` for refactor-to-PostgreSQL from SQL Server, or go back to `aws-database-selection` if SQL Server isn't the source, then ask the user whether to go back or proceed anyway. Do not silently misuse the artifact.\n5. Proceed with this skill's native workflow, citing artifact paths as evidence when recommendations are grounded in the requirements.\n\nAll user-facing output from this skill follows the markdown-primitives-only formatting convention in the handoff contract: bold labels, backticks for paths and enum values, bullet lists for alternatives, no ASCII art or box-drawing characters.\n",{"data":33,"body":35},{"name":4,"version":34,"description":6},1,{"type":36,"children":37},"root",[38,47,54,60,67,250,256,307,316,327,339,345,433,439,518,523,547,553,558,563,569,575,580,589,629,635,640,645,852,859,896,903,915,1168,1174,1179,1186,1319,1325,1330,1338,1451,1459,1605,1613,1765,1892,1900,1988,1996,2136,2142,2148,2153,2192,2198,2203,2232,2238,2243,2278,2284,2289,2325,2331,2360,2366,2387,2393,2398,2404,2430,2436,2606,2612,2649,2728,2733],{"type":39,"tag":40,"props":41,"children":43},"element","h1",{"id":42},"amazon-rds-for-sql-server",[44],{"type":45,"value":46},"text","Amazon RDS for SQL Server",{"type":39,"tag":48,"props":49,"children":51},"h2",{"id":50},"safety-guidance",[52],{"type":45,"value":53},"Safety guidance",{"type":39,"tag":55,"props":56,"children":57},"p",{},[58],{"type":45,"value":59},"This skill covers creating and modifying RDS for SQL Server resources when the user requests it. The agent MUST confirm the action with the user before executing. Do NOT execute any create or modify operation without explicit user confirmation (e.g., \"yes\", \"proceed\", \"confirmed\", \"go ahead\"). If the user has not confirmed, present the planned action and ask for approval.",{"type":39,"tag":61,"props":62,"children":64},"h3",{"id":63},"execute-these-operations-after-user-confirmation",[65],{"type":45,"value":66},"Execute these operations (after user confirmation)",{"type":39,"tag":68,"props":69,"children":70},"ul",{},[71,86,123,136,156,177,195,221,232],{"type":39,"tag":72,"props":73,"children":74},"li",{},[75,77,84],{"type":45,"value":76},"Create an instance: ",{"type":39,"tag":78,"props":79,"children":81},"code",{"className":80},[],[82],{"type":45,"value":83},"create-db-instance",{"type":45,"value":85}," (requires a DB subnet group; RDS SQL Server is VPC-only and not publicly accessible by default)",{"type":39,"tag":72,"props":87,"children":88},{},[89,91,97,99,105,107,113,115,121],{"type":45,"value":90},"Create a custom parameter group: ",{"type":39,"tag":78,"props":92,"children":94},{"className":93},[],[95],{"type":45,"value":96},"create-db-parameter-group",{"type":45,"value":98}," (family ",{"type":39,"tag":78,"props":100,"children":102},{"className":101},[],[103],{"type":45,"value":104},"sqlserver-ex-15.00",{"type":45,"value":106},", ",{"type":39,"tag":78,"props":108,"children":110},{"className":109},[],[111],{"type":45,"value":112},"sqlserver-se-15.00",{"type":45,"value":114},", etc.) — needed to set ",{"type":39,"tag":78,"props":116,"children":118},{"className":117},[],[119],{"type":45,"value":120},"rds.force_ssl=1",{"type":45,"value":122}," among others",{"type":39,"tag":72,"props":124,"children":125},{},[126,128,134],{"type":45,"value":127},"Create an option group: ",{"type":39,"tag":78,"props":129,"children":131},{"className":130},[],[132],{"type":45,"value":133},"create-option-group",{"type":45,"value":135}," (for TDE, S3 integration, SQLServer Audit, Native Backup\u002FRestore, SSIS, SSAS, SSRS)",{"type":39,"tag":72,"props":137,"children":138},{},[139,141,147,148,154],{"type":45,"value":140},"Create an RDS Proxy: ",{"type":39,"tag":78,"props":142,"children":144},{"className":143},[],[145],{"type":45,"value":146},"create-db-proxy",{"type":45,"value":106},{"type":39,"tag":78,"props":149,"children":151},{"className":150},[],[152],{"type":45,"value":153},"register-db-proxy-targets",{"type":45,"value":155}," (for IAM DB auth in front of SQL Server — see the rds-proxy reference)",{"type":39,"tag":72,"props":157,"children":158},{},[159,161,167,169,175],{"type":45,"value":160},"Create an AWS Managed Microsoft AD directory for Windows auth: ",{"type":39,"tag":78,"props":162,"children":164},{"className":163},[],[165],{"type":45,"value":166},"create-directory",{"type":45,"value":168}," (then associate via ",{"type":39,"tag":78,"props":170,"children":172},{"className":171},[],[173],{"type":45,"value":174},"modify-db-instance --domain",{"type":45,"value":176},")",{"type":39,"tag":72,"props":178,"children":179},{},[180,182,188,189],{"type":45,"value":181},"Create a Secrets Manager secret with rotation: ",{"type":39,"tag":78,"props":183,"children":185},{"className":184},[],[186],{"type":45,"value":187},"create-secret",{"type":45,"value":106},{"type":39,"tag":78,"props":190,"children":192},{"className":191},[],[193],{"type":45,"value":194},"rotate-secret --rotation-rules AutomaticallyAfterDays=N",{"type":39,"tag":72,"props":196,"children":197},{},[198,200,206,208,214,215],{"type":45,"value":199},"Change backup retention, deletion protection, log exports: ",{"type":39,"tag":78,"props":201,"children":203},{"className":202},[],[204],{"type":45,"value":205},"modify-db-instance --backup-retention-period",{"type":45,"value":207}," \u002F ",{"type":39,"tag":78,"props":209,"children":211},{"className":210},[],[212],{"type":45,"value":213},"--deletion-protection",{"type":45,"value":207},{"type":39,"tag":78,"props":216,"children":218},{"className":217},[],[219],{"type":45,"value":220},"--cloudwatch-logs-export-configuration",{"type":39,"tag":72,"props":222,"children":223},{},[224,226],{"type":45,"value":225},"Attach\u002Fdetach parameter group or option group: ",{"type":39,"tag":78,"props":227,"children":229},{"className":228},[],[230],{"type":45,"value":231},"modify-db-instance --db-parameter-group-name \u002F --option-group-name",{"type":39,"tag":72,"props":233,"children":234},{},[235,237,243,244],{"type":45,"value":236},"Tag resources: ",{"type":39,"tag":78,"props":238,"children":240},{"className":239},[],[241],{"type":45,"value":242},"add-tags-to-resource",{"type":45,"value":106},{"type":39,"tag":78,"props":245,"children":247},{"className":246},[],[248],{"type":45,"value":249},"remove-tags-from-resource",{"type":39,"tag":61,"props":251,"children":253},{"id":252},"resource-tagging-always-apply-on-resource-creation",[254],{"type":45,"value":255},"Resource tagging (always apply on resource creation)",{"type":39,"tag":55,"props":257,"children":258},{},[259,261,266,267,272,273,278,279,284,285,290,292,297,299,305],{"type":45,"value":260},"When creating any RDS for SQL Server resource (",{"type":39,"tag":78,"props":262,"children":264},{"className":263},[],[265],{"type":45,"value":83},{"type":45,"value":106},{"type":39,"tag":78,"props":268,"children":270},{"className":269},[],[271],{"type":45,"value":96},{"type":45,"value":106},{"type":39,"tag":78,"props":274,"children":276},{"className":275},[],[277],{"type":45,"value":133},{"type":45,"value":106},{"type":39,"tag":78,"props":280,"children":282},{"className":281},[],[283],{"type":45,"value":146},{"type":45,"value":106},{"type":39,"tag":78,"props":286,"children":288},{"className":287},[],[289],{"type":45,"value":187},{"type":45,"value":291}," for RDS credentials, ",{"type":39,"tag":78,"props":293,"children":295},{"className":294},[],[296],{"type":45,"value":166},{"type":45,"value":298}," for Windows auth), ALWAYS include these tags using the RDS list-of-records ",{"type":39,"tag":78,"props":300,"children":302},{"className":301},[],[303],{"type":45,"value":304},"--tags",{"type":45,"value":306}," syntax (AWS Directory Service and Secrets Manager use the same shape):",{"type":39,"tag":55,"props":308,"children":309},{},[310],{"type":39,"tag":78,"props":311,"children":313},{"className":312},[],[314],{"type":45,"value":315},"--tags Key=created_by,Value=rds-sqlserver-skill Key=generation_model,Value={your-model-id}",{"type":39,"tag":55,"props":317,"children":318},{},[319,321],{"type":45,"value":320},"Example: ",{"type":39,"tag":78,"props":322,"children":324},{"className":323},[],[325],{"type":45,"value":326},"--tags Key=created_by,Value=rds-sqlserver-skill Key=generation_model,Value=claude-sonnet-4-20250514",{"type":39,"tag":55,"props":328,"children":329},{},[330,332,337],{"type":45,"value":331},"Include these tags even if the user does not mention tagging, so that they can identify the resources created via this skill. If the user provides additional tags, append these to their tags rather than replacing them. The same applies when tagging via ",{"type":39,"tag":78,"props":333,"children":335},{"className":334},[],[336],{"type":45,"value":242},{"type":45,"value":338}," on existing resources.",{"type":39,"tag":61,"props":340,"children":342},{"id":341},"execute-with-downtime-warning-warn-user-then-execute-after-they-confirm",[343],{"type":45,"value":344},"Execute with downtime warning (warn user, then execute after they confirm)",{"type":39,"tag":68,"props":346,"children":347},{},[348,361,374,401,414],{"type":39,"tag":72,"props":349,"children":350},{},[351,353,359],{"type":45,"value":352},"Change instance class: ",{"type":39,"tag":78,"props":354,"children":356},{"className":355},[],[357],{"type":45,"value":358},"modify-db-instance --db-instance-class",{"type":45,"value":360}," — warn: \"This causes a failover in Multi-AZ configurations and brief unavailability on single-AZ instances.\"",{"type":39,"tag":72,"props":362,"children":363},{},[364,366,372],{"type":45,"value":365},"Minor engine version upgrade: ",{"type":39,"tag":78,"props":367,"children":369},{"className":368},[],[370],{"type":45,"value":371},"modify-db-instance --engine-version",{"type":45,"value":373}," within the same major (e.g., 15.00.4X → 15.00.4Y) — warn: \"This triggers a restart and may cause a brief outage.\"",{"type":39,"tag":72,"props":375,"children":376},{},[377,379,385,386,392,393,399],{"type":45,"value":378},"Storage type or IOPS change: ",{"type":39,"tag":78,"props":380,"children":382},{"className":381},[],[383],{"type":45,"value":384},"modify-db-instance --storage-type",{"type":45,"value":207},{"type":39,"tag":78,"props":387,"children":389},{"className":388},[],[390],{"type":45,"value":391},"--iops",{"type":45,"value":207},{"type":39,"tag":78,"props":394,"children":396},{"className":395},[],[397],{"type":45,"value":398},"--allocated-storage",{"type":45,"value":400}," — warn: \"This can cause extended IO degradation while the change applies.\"",{"type":39,"tag":72,"props":402,"children":403},{},[404,406,412],{"type":45,"value":405},"Apply immediately: any ",{"type":39,"tag":78,"props":407,"children":409},{"className":408},[],[410],{"type":45,"value":411},"modify-db-instance --apply-immediately",{"type":45,"value":413}," — warn: \"This applies outside the maintenance window and may cause downtime now.\"",{"type":39,"tag":72,"props":415,"children":416},{},[417,419,424,425,431],{"type":45,"value":418},"Domain join\u002Funjoin: ",{"type":39,"tag":78,"props":420,"children":422},{"className":421},[],[423],{"type":45,"value":174},{"type":45,"value":207},{"type":39,"tag":78,"props":426,"children":428},{"className":427},[],[429],{"type":45,"value":430},"--disable-domain",{"type":45,"value":432}," — warn: \"This restarts the instance.\"",{"type":39,"tag":61,"props":434,"children":436},{"id":435},"do-not-execute-refuse-explain-why-offer-assessment-instead",[437],{"type":45,"value":438},"Do NOT execute (refuse, explain why, offer assessment instead)",{"type":39,"tag":68,"props":440,"children":441},{},[442,455,468,481,493,505],{"type":39,"tag":72,"props":443,"children":444},{},[445,447,453],{"type":45,"value":446},"Delete instance: ",{"type":39,"tag":78,"props":448,"children":450},{"className":449},[],[451],{"type":45,"value":452},"delete-db-instance",{"type":45,"value":454}," — irreversible data loss",{"type":39,"tag":72,"props":456,"children":457},{},[458,460,466],{"type":45,"value":459},"Delete automated backups: ",{"type":39,"tag":78,"props":461,"children":463},{"className":462},[],[464],{"type":45,"value":465},"delete-db-instance --delete-automated-backups",{"type":45,"value":467}," — destroys point-in-time recovery history",{"type":39,"tag":72,"props":469,"children":470},{},[471,473,479],{"type":45,"value":472},"Failover: ",{"type":39,"tag":78,"props":474,"children":476},{"className":475},[],[477],{"type":45,"value":478},"reboot-db-instance --force-failover",{"type":45,"value":480}," — production impact",{"type":39,"tag":72,"props":482,"children":483},{},[484,486,491],{"type":45,"value":485},"Major version upgrade: ",{"type":39,"tag":78,"props":487,"children":489},{"className":488},[],[490],{"type":45,"value":371},{"type":45,"value":492}," across major versions (e.g., 15.0 → 16.0) — requires prechecks and a rollback plan; should go through change-control",{"type":39,"tag":72,"props":494,"children":495},{},[496,498,504],{"type":45,"value":497},"Reboot: ",{"type":39,"tag":78,"props":499,"children":501},{"className":500},[],[502],{"type":45,"value":503},"reboot-db-instance",{"type":45,"value":480},{"type":39,"tag":72,"props":506,"children":507},{},[508,510,516],{"type":45,"value":509},"Enable public accessibility: ",{"type":39,"tag":78,"props":511,"children":513},{"className":512},[],[514],{"type":45,"value":515},"modify-db-instance --publicly-accessible true",{"type":45,"value":517}," — security regression; use SSM port forwarding, VPN, or Direct Connect",{"type":39,"tag":55,"props":519,"children":520},{},[521],{"type":45,"value":522},"When refusing, explain why and offer the matching assessment workflow:",{"type":39,"tag":524,"props":525,"children":526},"blockquote",{},[527],{"type":39,"tag":55,"props":528,"children":529},{},[530,532,538,540,545],{"type":45,"value":531},"\"I can't perform ",{"type":39,"tag":533,"props":534,"children":535},"span",{},[536],{"type":45,"value":537},"action",{"type":45,"value":539}," because ",{"type":39,"tag":533,"props":541,"children":542},{},[543],{"type":45,"value":544},"reason",{"type":45,"value":546},". I can run an assessment to help you decide. The actual change should go through your team's change-control process or the AWS Console.\"",{"type":39,"tag":48,"props":548,"children":550},{"id":549},"overview",[551],{"type":45,"value":552},"Overview",{"type":39,"tag":55,"props":554,"children":555},{},[556],{"type":45,"value":557},"Amazon RDS for SQL Server is the managed SQL Server service from AWS. This skill covers the end-to-end workflow for connecting applications to RDS for SQL Server: driver selection, connection strings, SSL\u002FTLS encryption, SQL and Windows authentication, IAM authentication via RDS Proxy, connection pooling, VPC networking, deployment patterns for EC2 \u002F ECS \u002F Lambda \u002F EKS, and troubleshooting of the common error modes.",{"type":39,"tag":55,"props":559,"children":560},{},[561],{"type":45,"value":562},"This skill works with the AWS CLI directly. The AWS MCP server is recommended but not required — it adds sandboxed execution, CloudTrail audit, and observability when available.",{"type":39,"tag":48,"props":564,"children":566},{"id":565},"common-tasks",[567],{"type":45,"value":568},"Common Tasks",{"type":39,"tag":61,"props":570,"children":572},{"id":571},"_1-verify-dependencies",[573],{"type":45,"value":574},"1. Verify Dependencies",{"type":39,"tag":55,"props":576,"children":577},{},[578],{"type":45,"value":579},"Check for required tools and warn the user if any are missing.",{"type":39,"tag":55,"props":581,"children":582},{},[583],{"type":39,"tag":584,"props":585,"children":586},"strong",{},[587],{"type":45,"value":588},"Constraints:",{"type":39,"tag":68,"props":590,"children":591},{},[592,604,609],{"type":39,"tag":72,"props":593,"children":594},{},[595,597,603],{"type":45,"value":596},"You MUST verify that the AWS CLI is available (",{"type":39,"tag":78,"props":598,"children":600},{"className":599},[],[601],{"type":45,"value":602},"aws --version",{"type":45,"value":176},{"type":39,"tag":72,"props":605,"children":606},{},[607],{"type":45,"value":608},"You MUST inform the user if the AWS CLI is missing, because most steps need AWS API access",{"type":39,"tag":72,"props":610,"children":611},{},[612,614,620,621,627],{"type":45,"value":613},"If the AWS MCP server tools (",{"type":39,"tag":78,"props":615,"children":617},{"className":616},[],[618],{"type":45,"value":619},"call_aws",{"type":45,"value":106},{"type":39,"tag":78,"props":622,"children":624},{"className":623},[],[625],{"type":45,"value":626},"suggest_aws_commands",{"type":45,"value":628},") are available, prefer them for audit and observability — but they are NOT required",{"type":39,"tag":61,"props":630,"children":632},{"id":631},"_2-classify-and-route",[633],{"type":45,"value":634},"2. Classify and Route",{"type":39,"tag":55,"props":636,"children":637},{},[638],{"type":45,"value":639},"Collect the connection context and route to the right sub-skill reference file.",{"type":39,"tag":55,"props":641,"children":642},{},[643],{"type":45,"value":644},"Parameters:",{"type":39,"tag":68,"props":646,"children":647},{},[648,735,780,824,842],{"type":39,"tag":72,"props":649,"children":650},{},[651,656,658,664,666,672,673,679,680,686,688,694,696,702,704,710,712,718,719,725,727,733],{"type":39,"tag":584,"props":652,"children":653},{},[654],{"type":45,"value":655},"language",{"type":45,"value":657}," (required): ",{"type":39,"tag":78,"props":659,"children":661},{"className":660},[],[662],{"type":45,"value":663},"python",{"type":45,"value":665}," | ",{"type":39,"tag":78,"props":667,"children":669},{"className":668},[],[670],{"type":45,"value":671},"dotnet",{"type":45,"value":665},{"type":39,"tag":78,"props":674,"children":676},{"className":675},[],[677],{"type":45,"value":678},"java",{"type":45,"value":665},{"type":39,"tag":78,"props":681,"children":683},{"className":682},[],[684],{"type":45,"value":685},"nodejs",{"type":45,"value":687},". Infer from project files (",{"type":39,"tag":78,"props":689,"children":691},{"className":690},[],[692],{"type":45,"value":693},"requirements.txt",{"type":45,"value":695},"\u002F",{"type":39,"tag":78,"props":697,"children":699},{"className":698},[],[700],{"type":45,"value":701},"*.py",{"type":45,"value":703}," → python; ",{"type":39,"tag":78,"props":705,"children":707},{"className":706},[],[708],{"type":45,"value":709},"*.csproj",{"type":45,"value":711}," → dotnet; ",{"type":39,"tag":78,"props":713,"children":715},{"className":714},[],[716],{"type":45,"value":717},"pom.xml",{"type":45,"value":695},{"type":39,"tag":78,"props":720,"children":722},{"className":721},[],[723],{"type":45,"value":724},"build.gradle",{"type":45,"value":726}," → java; ",{"type":39,"tag":78,"props":728,"children":730},{"className":729},[],[731],{"type":45,"value":732},"package.json",{"type":45,"value":734}," → nodejs). Ask only if ambiguous.",{"type":39,"tag":72,"props":736,"children":737},{},[738,743,744,750,751,757,758,764,765,771,772,778],{"type":39,"tag":584,"props":739,"children":740},{},[741],{"type":45,"value":742},"runtime",{"type":45,"value":657},{"type":39,"tag":78,"props":745,"children":747},{"className":746},[],[748],{"type":45,"value":749},"ec2",{"type":45,"value":665},{"type":39,"tag":78,"props":752,"children":754},{"className":753},[],[755],{"type":45,"value":756},"ecs",{"type":45,"value":665},{"type":39,"tag":78,"props":759,"children":761},{"className":760},[],[762],{"type":45,"value":763},"lambda",{"type":45,"value":665},{"type":39,"tag":78,"props":766,"children":768},{"className":767},[],[769],{"type":45,"value":770},"eks",{"type":45,"value":665},{"type":39,"tag":78,"props":773,"children":775},{"className":774},[],[776],{"type":45,"value":777},"laptop",{"type":45,"value":779},". Drives networking + secrets pattern.",{"type":39,"tag":72,"props":781,"children":782},{},[783,788,789,794,795,801,802,808,809,815,817,822],{"type":39,"tag":584,"props":784,"children":785},{},[786],{"type":45,"value":787},"auth",{"type":45,"value":657},{"type":39,"tag":78,"props":790,"children":792},{"className":791},[],[793],{"type":45,"value":18},{"type":45,"value":665},{"type":39,"tag":78,"props":796,"children":798},{"className":797},[],[799],{"type":45,"value":800},"windows-kerberos",{"type":45,"value":665},{"type":39,"tag":78,"props":803,"children":805},{"className":804},[],[806],{"type":45,"value":807},"windows-ntlm",{"type":45,"value":665},{"type":39,"tag":78,"props":810,"children":812},{"className":811},[],[813],{"type":45,"value":814},"iam-proxy",{"type":45,"value":816},". Default ",{"type":39,"tag":78,"props":818,"children":820},{"className":819},[],[821],{"type":45,"value":18},{"type":45,"value":823}," unless the user mentions Active Directory, Kerberos, NTLM, or IAM.",{"type":39,"tag":72,"props":825,"children":826},{},[827,832,834,840],{"type":39,"tag":584,"props":828,"children":829},{},[830],{"type":45,"value":831},"region",{"type":45,"value":833}," (required): AWS region, e.g. ",{"type":39,"tag":78,"props":835,"children":837},{"className":836},[],[838],{"type":45,"value":839},"us-east-1",{"type":45,"value":841},".",{"type":39,"tag":72,"props":843,"children":844},{},[845,850],{"type":39,"tag":584,"props":846,"children":847},{},[848],{"type":45,"value":849},"db_instance_id",{"type":45,"value":851}," (required for troubleshooting): RDS instance identifier.",{"type":39,"tag":55,"props":853,"children":854},{},[855],{"type":39,"tag":584,"props":856,"children":857},{},[858],{"type":45,"value":588},{"type":39,"tag":68,"props":860,"children":861},{},[862,867,879,891],{"type":39,"tag":72,"props":863,"children":864},{},[865],{"type":45,"value":866},"You MUST ask for all required parameters upfront in a single prompt, because iterative questioning frustrates users",{"type":39,"tag":72,"props":868,"children":869},{},[870,872,877],{"type":45,"value":871},"You MUST infer ",{"type":39,"tag":78,"props":873,"children":875},{"className":874},[],[876],{"type":45,"value":655},{"type":45,"value":878}," from project files when available rather than asking",{"type":39,"tag":72,"props":880,"children":881},{},[882,884,889],{"type":45,"value":883},"You MUST validate ",{"type":39,"tag":78,"props":885,"children":887},{"className":886},[],[888],{"type":45,"value":831},{"type":45,"value":890}," against the enumerated list of AWS regions before proceeding",{"type":39,"tag":72,"props":892,"children":893},{},[894],{"type":45,"value":895},"You SHOULD default to SQL authentication unless the user explicitly says Windows auth, IAM auth, or Active Directory",{"type":39,"tag":897,"props":898,"children":900},"h4",{"id":899},"sub-skill-routing",[901],{"type":45,"value":902},"Sub-skill routing",{"type":39,"tag":55,"props":904,"children":905},{},[906,908,913],{"type":45,"value":907},"Load ",{"type":39,"tag":584,"props":909,"children":910},{},[911],{"type":45,"value":912},"exactly one driver",{"type":45,"value":914}," reference plus any relevant topic references:",{"type":39,"tag":916,"props":917,"children":918},"table",{},[919,938],{"type":39,"tag":920,"props":921,"children":922},"thead",{},[923],{"type":39,"tag":924,"props":925,"children":926},"tr",{},[927,933],{"type":39,"tag":928,"props":929,"children":930},"th",{},[931],{"type":45,"value":932},"User is doing",{"type":39,"tag":928,"props":934,"children":935},{},[936],{"type":45,"value":937},"Load",{"type":39,"tag":939,"props":940,"children":941},"tbody",{},[942,960,976,992,1008,1024,1040,1056,1072,1088,1104,1120,1136,1152],{"type":39,"tag":924,"props":943,"children":944},{},[945,951],{"type":39,"tag":946,"props":947,"children":948},"td",{},[949],{"type":45,"value":950},"Python \u002F pymssql \u002F pyodbc",{"type":39,"tag":946,"props":952,"children":953},{},[954],{"type":39,"tag":955,"props":956,"children":958},"a",{"href":957},"references\u002Fpython.md",[959],{"type":45,"value":957},{"type":39,"tag":924,"props":961,"children":962},{},[963,968],{"type":39,"tag":946,"props":964,"children":965},{},[966],{"type":45,"value":967},".NET \u002F C# \u002F Microsoft.Data.SqlClient",{"type":39,"tag":946,"props":969,"children":970},{},[971],{"type":39,"tag":955,"props":972,"children":974},{"href":973},"references\u002Fdotnet.md",[975],{"type":45,"value":973},{"type":39,"tag":924,"props":977,"children":978},{},[979,984],{"type":39,"tag":946,"props":980,"children":981},{},[982],{"type":45,"value":983},"Java \u002F JDBC \u002F mssql-jdbc",{"type":39,"tag":946,"props":985,"children":986},{},[987],{"type":39,"tag":955,"props":988,"children":990},{"href":989},"references\u002Fjava.md",[991],{"type":45,"value":989},{"type":39,"tag":924,"props":993,"children":994},{},[995,1000],{"type":39,"tag":946,"props":996,"children":997},{},[998],{"type":45,"value":999},"Node.js \u002F tedious \u002F mssql",{"type":39,"tag":946,"props":1001,"children":1002},{},[1003],{"type":39,"tag":955,"props":1004,"children":1006},{"href":1005},"references\u002Fnodejs.md",[1007],{"type":45,"value":1005},{"type":39,"tag":924,"props":1009,"children":1010},{},[1011,1016],{"type":39,"tag":946,"props":1012,"children":1013},{},[1014],{"type":45,"value":1015},"EC2 hosting",{"type":39,"tag":946,"props":1017,"children":1018},{},[1019],{"type":39,"tag":955,"props":1020,"children":1022},{"href":1021},"references\u002Fec2-vpc.md",[1023],{"type":45,"value":1021},{"type":39,"tag":924,"props":1025,"children":1026},{},[1027,1032],{"type":39,"tag":946,"props":1028,"children":1029},{},[1030],{"type":45,"value":1031},"Lambda hosting",{"type":39,"tag":946,"props":1033,"children":1034},{},[1035],{"type":39,"tag":955,"props":1036,"children":1038},{"href":1037},"references\u002Flambda-vpc.md",[1039],{"type":45,"value":1037},{"type":39,"tag":924,"props":1041,"children":1042},{},[1043,1048],{"type":39,"tag":946,"props":1044,"children":1045},{},[1046],{"type":45,"value":1047},"ECS or Fargate hosting",{"type":39,"tag":946,"props":1049,"children":1050},{},[1051],{"type":39,"tag":955,"props":1052,"children":1054},{"href":1053},"references\u002Fecs-fargate-vpc.md",[1055],{"type":45,"value":1053},{"type":39,"tag":924,"props":1057,"children":1058},{},[1059,1064],{"type":39,"tag":946,"props":1060,"children":1061},{},[1062],{"type":45,"value":1063},"Laptop via SSM tunnel",{"type":39,"tag":946,"props":1065,"children":1066},{},[1067],{"type":39,"tag":955,"props":1068,"children":1070},{"href":1069},"references\u002Fssm-tunneling.md",[1071],{"type":45,"value":1069},{"type":39,"tag":924,"props":1073,"children":1074},{},[1075,1080],{"type":39,"tag":946,"props":1076,"children":1077},{},[1078],{"type":45,"value":1079},"SSL\u002FTLS, rds.force_ssl, certificates",{"type":39,"tag":946,"props":1081,"children":1082},{},[1083],{"type":39,"tag":955,"props":1084,"children":1086},{"href":1085},"references\u002Fencryption.md",[1087],{"type":45,"value":1085},{"type":39,"tag":924,"props":1089,"children":1090},{},[1091,1096],{"type":39,"tag":946,"props":1092,"children":1093},{},[1094],{"type":45,"value":1095},"Windows \u002F AD \u002F Kerberos \u002F NTLM",{"type":39,"tag":946,"props":1097,"children":1098},{},[1099],{"type":39,"tag":955,"props":1100,"children":1102},{"href":1101},"references\u002Fad-kerberos.md",[1103],{"type":45,"value":1101},{"type":39,"tag":924,"props":1105,"children":1106},{},[1107,1112],{"type":39,"tag":946,"props":1108,"children":1109},{},[1110],{"type":45,"value":1111},"Cross-VPC, Transit Gateway, VPC peering",{"type":39,"tag":946,"props":1113,"children":1114},{},[1115],{"type":39,"tag":955,"props":1116,"children":1118},{"href":1117},"references\u002Fnetworking.md",[1119],{"type":45,"value":1117},{"type":39,"tag":924,"props":1121,"children":1122},{},[1123,1128],{"type":39,"tag":946,"props":1124,"children":1125},{},[1126],{"type":45,"value":1127},"SQL auth, Secrets Manager, credentials",{"type":39,"tag":946,"props":1129,"children":1130},{},[1131],{"type":39,"tag":955,"props":1132,"children":1134},{"href":1133},"references\u002Fconnection-auth.md",[1135],{"type":45,"value":1133},{"type":39,"tag":924,"props":1137,"children":1138},{},[1139,1144],{"type":39,"tag":946,"props":1140,"children":1141},{},[1142],{"type":45,"value":1143},"IAM auth, RDS Proxy, connection pooling",{"type":39,"tag":946,"props":1145,"children":1146},{},[1147],{"type":39,"tag":955,"props":1148,"children":1150},{"href":1149},"references\u002Frds-proxy.md",[1151],{"type":45,"value":1149},{"type":39,"tag":924,"props":1153,"children":1154},{},[1155,1160],{"type":39,"tag":946,"props":1156,"children":1157},{},[1158],{"type":45,"value":1159},"Errors, connection failures, Kerberos falls back to NTLM",{"type":39,"tag":946,"props":1161,"children":1162},{},[1163],{"type":39,"tag":955,"props":1164,"children":1166},{"href":1165},"references\u002Ftroubleshooting.md",[1167],{"type":45,"value":1165},{"type":39,"tag":61,"props":1169,"children":1171},{"id":1170},"_3-execute-the-workflow",[1172],{"type":45,"value":1173},"3. Execute the Workflow",{"type":39,"tag":55,"props":1175,"children":1176},{},[1177],{"type":45,"value":1178},"Follow the steps in the loaded reference files in order: driver setup → networking → auth → secrets → verify.",{"type":39,"tag":55,"props":1180,"children":1181},{},[1182],{"type":39,"tag":584,"props":1183,"children":1184},{},[1185],{"type":45,"value":588},{"type":39,"tag":68,"props":1187,"children":1188},{},[1189,1202,1207,1244,1265,1278,1283,1288,1293,1298],{"type":39,"tag":72,"props":1190,"children":1191},{},[1192,1194,1200],{"type":45,"value":1193},"You MUST use ",{"type":39,"tag":78,"props":1195,"children":1197},{"className":1196},[],[1198],{"type":45,"value":1199},"TLS 1.2",{"type":45,"value":1201}," or higher for all connections, because older TLS versions have known vulnerabilities",{"type":39,"tag":72,"props":1203,"children":1204},{},[1205],{"type":45,"value":1206},"You MUST fetch credentials from AWS Secrets Manager rather than embedding passwords in code, because hardcoded secrets leak into logs and source control",{"type":39,"tag":72,"props":1208,"children":1209},{},[1210,1212,1218,1220,1226,1228,1234,1236,1242],{"type":45,"value":1211},"You MUST set ",{"type":39,"tag":78,"props":1213,"children":1215},{"className":1214},[],[1216],{"type":45,"value":1217},"Encrypt=Mandatory",{"type":45,"value":1219}," (.NET) \u002F ",{"type":39,"tag":78,"props":1221,"children":1223},{"className":1222},[],[1224],{"type":45,"value":1225},"encrypt=true",{"type":45,"value":1227}," (JDBC) \u002F ",{"type":39,"tag":78,"props":1229,"children":1231},{"className":1230},[],[1232],{"type":45,"value":1233},"encryption=\"require\"",{"type":45,"value":1235}," (pymssql) \u002F ",{"type":39,"tag":78,"props":1237,"children":1239},{"className":1238},[],[1240],{"type":45,"value":1241},"encrypt: true",{"type":45,"value":1243}," (tedious) in production, because opportunistic encryption may silently fall back to plaintext",{"type":39,"tag":72,"props":1245,"children":1246},{},[1247,1249,1255,1257,1263],{"type":45,"value":1248},"You MUST verify server certificate chain using the RDS CA bundle from ",{"type":39,"tag":78,"props":1250,"children":1252},{"className":1251},[],[1253],{"type":45,"value":1254},"https:\u002F\u002Ftruststore.pki.rds.amazonaws.com\u002Fglobal\u002Fglobal-bundle.pem",{"type":45,"value":1256}," rather than setting ",{"type":39,"tag":78,"props":1258,"children":1260},{"className":1259},[],[1261],{"type":45,"value":1262},"TrustServerCertificate=true",{"type":45,"value":1264}," in production, because disabling verification exposes you to MITM attacks",{"type":39,"tag":72,"props":1266,"children":1267},{},[1268,1270,1276],{"type":45,"value":1269},"You MUST NOT enable ",{"type":39,"tag":78,"props":1271,"children":1273},{"className":1272},[],[1274],{"type":45,"value":1275},"PubliclyAccessible: true",{"type":45,"value":1277}," on the DB instance, because it exposes SQL Server port 1433 to the public internet",{"type":39,"tag":72,"props":1279,"children":1280},{},[1281],{"type":45,"value":1282},"You MUST use security group IDs as the source for same-VPC access and CIDR blocks for cross-VPC access via Transit Gateway or VPC peering, because SG references don't cross VPC boundaries",{"type":39,"tag":72,"props":1284,"children":1285},{},[1286],{"type":45,"value":1287},"You MUST NOT use IAM authentication directly against RDS for SQL Server, because RDS for SQL Server does not support it — IAM auth requires RDS Proxy in front of the instance",{"type":39,"tag":72,"props":1289,"children":1290},{},[1291],{"type":45,"value":1292},"You MUST test Windows authentication from a domain-joined host (EC2 or client), not via SSM send-command, because SSM runs as the system account, not the user's AD identity",{"type":39,"tag":72,"props":1294,"children":1295},{},[1296],{"type":45,"value":1297},"You SHOULD prefer Kerberos over NTLM when both are available, because Kerberos is cryptographically stronger and easier to audit",{"type":39,"tag":72,"props":1299,"children":1300},{},[1301,1303,1309,1311,1317],{"type":45,"value":1302},"You SHOULD use ",{"type":39,"tag":78,"props":1304,"children":1306},{"className":1305},[],[1307],{"type":45,"value":1308},"pyodbc",{"type":45,"value":1310}," instead of ",{"type":39,"tag":78,"props":1312,"children":1314},{"className":1313},[],[1315],{"type":45,"value":1316},"pymssql",{"type":45,"value":1318}," when the application requires Kerberos\u002FWindows authentication, because pymssql does not support Kerberos",{"type":39,"tag":61,"props":1320,"children":1322},{"id":1321},"rubric-critical-facts-to-always-surface",[1323],{"type":45,"value":1324},"Rubric-Critical Facts to Always Surface",{"type":39,"tag":55,"props":1326,"children":1327},{},[1328],{"type":45,"value":1329},"These RDS-for-SQL-Server-specific facts differentiate this skill from general SQL Server knowledge. Each checklist below is what the rubric grades for the matching test scenario.",{"type":39,"tag":55,"props":1331,"children":1332},{},[1333],{"type":39,"tag":584,"props":1334,"children":1335},{},[1336],{"type":45,"value":1337},"For \"unable to connect to RDS SQL Server from EC2 — SSMS times out\", you MUST tell the user ALL of the following six facts — and MUST investigate systematically rather than dumping a generic checklist:",{"type":39,"tag":1339,"props":1340,"children":1341},"ol",{},[1342,1352,1362,1372,1390,1416,1434],{"type":39,"tag":72,"props":1343,"children":1344},{},[1345,1350],{"type":39,"tag":584,"props":1346,"children":1347},{},[1348],{"type":45,"value":1349},"Ask which RDS instance and which source EC2 you're debugging",{"type":45,"value":1351}," — do NOT start troubleshooting without those two identifiers. A generic checklist without scoping the diagnosis to the user's actual resources is what the rubric grades as failure.",{"type":39,"tag":72,"props":1353,"children":1354},{},[1355,1360],{"type":39,"tag":584,"props":1356,"children":1357},{},[1358],{"type":45,"value":1359},"Check VPC and subnet connectivity",{"type":45,"value":1361}," between the EC2 and the RDS (same VPC, or VPC peering\u002FTransit Gateway with routable paths).",{"type":39,"tag":72,"props":1363,"children":1364},{},[1365,1370],{"type":39,"tag":584,"props":1366,"children":1367},{},[1368],{"type":45,"value":1369},"Security group on RDS allows 1433 inbound from EC2's SG",{"type":45,"value":1371}," (by SG id, not CIDR). The SG rule is the most common fix.",{"type":39,"tag":72,"props":1373,"children":1374},{},[1375,1380,1382,1388],{"type":39,"tag":584,"props":1376,"children":1377},{},[1378],{"type":45,"value":1379},"DNS resolution of the RDS endpoint",{"type":45,"value":1381}," from the EC2 — run ",{"type":39,"tag":78,"props":1383,"children":1385},{"className":1384},[],[1386],{"type":45,"value":1387},"nslookup \u003Crds-endpoint>",{"type":45,"value":1389}," from the EC2 and confirm it returns a private IP.",{"type":39,"tag":72,"props":1391,"children":1392},{},[1393,1398,1400,1406,1408,1414],{"type":39,"tag":584,"props":1394,"children":1395},{},[1396],{"type":45,"value":1397},"TCP connectivity on port 1433",{"type":45,"value":1399}," — run ",{"type":39,"tag":78,"props":1401,"children":1403},{"className":1402},[],[1404],{"type":45,"value":1405},"Test-NetConnection -ComputerName \u003Crds-endpoint> -Port 1433",{"type":45,"value":1407}," from PowerShell or ",{"type":39,"tag":78,"props":1409,"children":1411},{"className":1410},[],[1412],{"type":45,"value":1413},"telnet \u003Crds-endpoint> 1433",{"type":45,"value":1415},". If this fails while DNS works, the problem is in the SG or NACLs.",{"type":39,"tag":72,"props":1417,"children":1418},{},[1419,1424,1426,1432],{"type":39,"tag":584,"props":1420,"children":1421},{},[1422],{"type":45,"value":1423},"Publicly accessible flag only if the instance is on a public subnet",{"type":45,"value":1425}," — check ",{"type":39,"tag":78,"props":1427,"children":1429},{"className":1428},[],[1430],{"type":45,"value":1431},"PubliclyAccessible",{"type":45,"value":1433}," in describe-db-instances; a public endpoint on a private subnet is unreachable.",{"type":39,"tag":72,"props":1435,"children":1436},{},[1437,1442,1444,1449],{"type":39,"tag":584,"props":1438,"children":1439},{},[1440],{"type":45,"value":1441},"Suggest SSMS Options → Connection Properties → Network Protocol = TCP\u002FIP",{"type":45,"value":1443}," if the default protocol is misbehaving. ",{"type":39,"tag":584,"props":1445,"children":1446},{},[1447],{"type":45,"value":1448},"This specific SSMS dialog tip MUST appear in the response",{"type":45,"value":1450}," — the rubric fails responses that list all other checks but omit this one SSMS-specific suggestion.",{"type":39,"tag":55,"props":1452,"children":1453},{},[1454],{"type":39,"tag":584,"props":1455,"children":1456},{},[1457],{"type":45,"value":1458},"For \"Cannot generate SSPI context\" error with Windows auth, you MUST tell the user ALL of the following six facts:",{"type":39,"tag":1339,"props":1460,"children":1461},{},[1462,1472,1498,1545,1571,1581],{"type":39,"tag":72,"props":1463,"children":1464},{},[1465,1470],{"type":39,"tag":584,"props":1466,"children":1467},{},[1468],{"type":45,"value":1469},"Ask whether the connection worked before",{"type":45,"value":1471}," — this tells you whether you're diagnosing a setup problem (never worked) or a regression (worked, then broke). The diagnostic paths are different. Do NOT skip this triage step.",{"type":39,"tag":72,"props":1473,"children":1474},{},[1475,1480,1482,1488,1490,1496],{"type":39,"tag":584,"props":1476,"children":1477},{},[1478],{"type":45,"value":1479},"Check domain-join state of the client",{"type":45,"value":1481}," — on Windows run ",{"type":39,"tag":78,"props":1483,"children":1485},{"className":1484},[],[1486],{"type":45,"value":1487},"nltest \u002Fdsgetdc:\u003Cdomain>",{"type":45,"value":1489}," or ",{"type":39,"tag":78,"props":1491,"children":1493},{"className":1492},[],[1494],{"type":45,"value":1495},"systeminfo | findstr \u002FB \u002FC:\"Domain\"",{"type":45,"value":1497},". The client must be domain-joined to the AD that the RDS instance trusts.",{"type":39,"tag":72,"props":1499,"children":1500},{},[1501,1514,1516,1522,1524,1536,1538,1543],{"type":39,"tag":584,"props":1502,"children":1503},{},[1504,1506,1512],{"type":45,"value":1505},"Run ",{"type":39,"tag":78,"props":1507,"children":1509},{"className":1508},[],[1510],{"type":45,"value":1511},"klist",{"type":45,"value":1513}," to inspect Kerberos tickets",{"type":45,"value":1515}," — look for tickets for ",{"type":39,"tag":78,"props":1517,"children":1519},{"className":1518},[],[1520],{"type":45,"value":1521},"MSSQLSvc\u002F\u003Csql-server-host>:\u003Cport>",{"type":45,"value":1523},". If no ticket, Kerberos isn't working. ",{"type":39,"tag":584,"props":1525,"children":1526},{},[1527,1529,1534],{"type":45,"value":1528},"You MUST mention ",{"type":39,"tag":78,"props":1530,"children":1532},{"className":1531},[],[1533],{"type":45,"value":1511},{"type":45,"value":1535}," by name in the very first response",{"type":45,"value":1537},", not as a \"later diagnostic\" — the rubric explicitly greps for ",{"type":39,"tag":78,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":45,"value":1511},{"type":45,"value":1544}," in the first-message output. Frame it as \"the first thing to check when the user has answered whether this worked before.\"",{"type":39,"tag":72,"props":1546,"children":1547},{},[1548,1553,1555,1561,1563,1569],{"type":39,"tag":584,"props":1549,"children":1550},{},[1551],{"type":45,"value":1552},"Verify SPN registration",{"type":45,"value":1554}," for ",{"type":39,"tag":78,"props":1556,"children":1558},{"className":1557},[],[1559],{"type":45,"value":1560},"MSSQLSvc\u002F\u003Ccname>:1433",{"type":45,"value":1562}," on the RDS instance in AWS Managed Microsoft AD — run ",{"type":39,"tag":78,"props":1564,"children":1566},{"className":1565},[],[1567],{"type":45,"value":1568},"setspn -L \u003Cservice-account>",{"type":45,"value":1570}," or check the directory service. Missing SPN is the most common SSPI cause.",{"type":39,"tag":72,"props":1572,"children":1573},{},[1574,1579],{"type":39,"tag":584,"props":1575,"children":1576},{},[1577],{"type":45,"value":1578},"Confirm DNS resolution",{"type":45,"value":1580}," — the client's DNS must resolve the RDS endpoint (or its AD-joined CNAME) to the AD-joined name that matches the SPN. Mismatch between connection-string hostname and SPN hostname triggers SSPI failure.",{"type":39,"tag":72,"props":1582,"children":1583},{},[1584,1589,1591,1596,1598,1603],{"type":39,"tag":584,"props":1585,"children":1586},{},[1587],{"type":45,"value":1588},"Narrow based on the answers — do NOT dump every possible SSPI cause at once.",{"type":45,"value":1590}," Ask the \"worked before?\" question FIRST. Then present ",{"type":39,"tag":584,"props":1592,"children":1593},{},[1594],{"type":45,"value":1595},"klist as the next concrete step",{"type":45,"value":1597}," (\"run klist and tell me what you see\"). Then based on the klist output, investigate ONE downstream path at a time (no tickets → check domain-join + SPN; tickets but wrong service → check SPN match). ",{"type":39,"tag":584,"props":1599,"children":1600},{},[1601],{"type":45,"value":1602},"Listing klist, domain-join, SPN, and DNS as a simultaneous four-bullet diagnostic is \"dumping.\" Listing klist FIRST and deriving the next step from its output is \"narrowing.\" Do the latter.",{"type":45,"value":1604}," The rubric will fail both (a) omitting klist entirely and (b) dumping all four causes upfront. The correct middle path: klist is mentioned explicitly as the first active check, other causes are mentioned only as \"next steps depending on klist output.\"",{"type":39,"tag":55,"props":1606,"children":1607},{},[1608],{"type":39,"tag":584,"props":1609,"children":1610},{},[1611],{"type":45,"value":1612},"For \"Lambda with pymssql to RDS SQL Server\", you MUST tell the user ALL of the following eight facts:",{"type":39,"tag":1339,"props":1614,"children":1615},{},[1616,1633,1649,1664,1690,1707,1717,1734],{"type":39,"tag":72,"props":1617,"children":1618},{},[1619,1631],{"type":39,"tag":584,"props":1620,"children":1621},{},[1622,1624,1629],{"type":45,"value":1623},"Use ",{"type":39,"tag":78,"props":1625,"children":1627},{"className":1626},[],[1628],{"type":45,"value":1316},{"type":45,"value":1630}," (not pyodbc)",{"type":45,"value":1632}," in the example code — the user asked for pymssql specifically.",{"type":39,"tag":72,"props":1634,"children":1635},{},[1636,1647],{"type":39,"tag":584,"props":1637,"children":1638},{},[1639,1641],{"type":45,"value":1640},"Set ",{"type":39,"tag":78,"props":1642,"children":1644},{"className":1643},[],[1645],{"type":45,"value":1646},"encryption='require'",{"type":45,"value":1648}," in the connection call — forces TLS and fails fast if the server rejects it.",{"type":39,"tag":72,"props":1650,"children":1651},{},[1652,1662],{"type":39,"tag":584,"props":1653,"children":1654},{},[1655,1656],{"type":45,"value":1640},{"type":39,"tag":78,"props":1657,"children":1659},{"className":1658},[],[1660],{"type":45,"value":1661},"tds_version='7.4'",{"type":45,"value":1663}," — older TDS versions lack the TLS\u002Fauth features RDS needs. 7.4 is the minimum supported on current RDS SQL Server.",{"type":39,"tag":72,"props":1665,"children":1666},{},[1667,1672,1674,1680,1682,1688],{"type":39,"tag":584,"props":1668,"children":1669},{},[1670],{"type":45,"value":1671},"Pass the port as a STRING",{"type":45,"value":1673}," — ",{"type":39,"tag":78,"props":1675,"children":1677},{"className":1676},[],[1678],{"type":45,"value":1679},"port='1433'",{"type":45,"value":1681},", not ",{"type":39,"tag":78,"props":1683,"children":1685},{"className":1684},[],[1686],{"type":45,"value":1687},"port=1433",{"type":45,"value":1689},". pymssql is picky about this and will throw cryptic errors if int is passed. Call this out as a pymssql gotcha.",{"type":39,"tag":72,"props":1691,"children":1692},{},[1693,1698,1700,1705],{"type":39,"tag":584,"props":1694,"children":1695},{},[1696],{"type":45,"value":1697},"Pull credentials from Secrets Manager at cold start",{"type":45,"value":1699}," using ",{"type":39,"tag":584,"props":1701,"children":1702},{},[1703],{"type":45,"value":1704},"module-level code",{"type":45,"value":1706}," (outside the handler) so Lambda's per-container reuse keeps the secret cached and doesn't call Secrets Manager on every invocation.",{"type":39,"tag":72,"props":1708,"children":1709},{},[1710,1715],{"type":39,"tag":584,"props":1711,"children":1712},{},[1713],{"type":45,"value":1714},"Recommend fronting with RDS Proxy",{"type":45,"value":1716}," if the invocation rate is high — Lambda's cold-container churn opens and drops connections rapidly; Proxy pools them.",{"type":39,"tag":72,"props":1718,"children":1719},{},[1720,1725,1727,1732],{"type":39,"tag":584,"props":1721,"children":1722},{},[1723],{"type":45,"value":1724},"Lambda placed in a VPC",{"type":45,"value":1726}," with security group egress to RDS on 1433, and a ",{"type":39,"tag":584,"props":1728,"children":1729},{},[1730],{"type":45,"value":1731},"VPC endpoint for Secrets Manager",{"type":45,"value":1733}," (so the Lambda doesn't need internet egress). Both are required for a production VPC Lambda.",{"type":39,"tag":72,"props":1735,"children":1736},{},[1737,1742,1744,1749,1751,1756,1758,1763],{"type":39,"tag":584,"props":1738,"children":1739},{},[1740],{"type":45,"value":1741},"Full handler with error handling",{"type":45,"value":1743}," — specifically catch ",{"type":39,"tag":584,"props":1745,"children":1746},{},[1747],{"type":45,"value":1748},"login failure (error 18456)",{"type":45,"value":1750}," and ",{"type":39,"tag":584,"props":1752,"children":1753},{},[1754],{"type":45,"value":1755},"pre-login timeout",{"type":45,"value":1757},". ",{"type":39,"tag":584,"props":1759,"children":1760},{},[1761],{"type":45,"value":1762},"The code sample you provide MUST include both exception handlers",{"type":45,"value":1764}," — do NOT just mention them in prose. Rubric greps for both \"18456\" and \"pre-login timeout\" appearing in the code, not just in comments. Example pattern to include:",{"type":39,"tag":1766,"props":1767,"children":1771},"pre",{"className":1768,"code":1769,"language":663,"meta":1770,"style":1770},"language-python shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","try:\n    conn = pymssql.connect(server=host, port='1433', user=user, password=pw,\n                            database=db, encryption='require', tds_version='7.4',\n                            login_timeout=5)\nexcept pymssql.OperationalError as e:\n    msg = str(e)\n    if '18456' in msg or 'Login failed' in msg:\n        # error 18456: bad credentials \u002F wrong database \u002F disabled login\n        raise RuntimeError(f\"Login failed (18456): {e}\")\n    if 'pre-login' in msg.lower() or 'timeout' in msg.lower():\n        # pre-login timeout: network path or RDS unhealthy\n        raise RuntimeError(f\"Pre-login timeout: {e}\")\n    raise\n","",[1772],{"type":39,"tag":78,"props":1773,"children":1774},{"__ignoreMap":1770},[1775,1784,1793,1802,1811,1820,1829,1838,1847,1856,1865,1874,1883],{"type":39,"tag":533,"props":1776,"children":1778},{"class":1777,"line":34},"line",[1779],{"type":39,"tag":533,"props":1780,"children":1781},{},[1782],{"type":45,"value":1783},"try:\n",{"type":39,"tag":533,"props":1785,"children":1787},{"class":1777,"line":1786},2,[1788],{"type":39,"tag":533,"props":1789,"children":1790},{},[1791],{"type":45,"value":1792},"    conn = pymssql.connect(server=host, port='1433', user=user, password=pw,\n",{"type":39,"tag":533,"props":1794,"children":1796},{"class":1777,"line":1795},3,[1797],{"type":39,"tag":533,"props":1798,"children":1799},{},[1800],{"type":45,"value":1801},"                            database=db, encryption='require', tds_version='7.4',\n",{"type":39,"tag":533,"props":1803,"children":1805},{"class":1777,"line":1804},4,[1806],{"type":39,"tag":533,"props":1807,"children":1808},{},[1809],{"type":45,"value":1810},"                            login_timeout=5)\n",{"type":39,"tag":533,"props":1812,"children":1814},{"class":1777,"line":1813},5,[1815],{"type":39,"tag":533,"props":1816,"children":1817},{},[1818],{"type":45,"value":1819},"except pymssql.OperationalError as e:\n",{"type":39,"tag":533,"props":1821,"children":1823},{"class":1777,"line":1822},6,[1824],{"type":39,"tag":533,"props":1825,"children":1826},{},[1827],{"type":45,"value":1828},"    msg = str(e)\n",{"type":39,"tag":533,"props":1830,"children":1832},{"class":1777,"line":1831},7,[1833],{"type":39,"tag":533,"props":1834,"children":1835},{},[1836],{"type":45,"value":1837},"    if '18456' in msg or 'Login failed' in msg:\n",{"type":39,"tag":533,"props":1839,"children":1841},{"class":1777,"line":1840},8,[1842],{"type":39,"tag":533,"props":1843,"children":1844},{},[1845],{"type":45,"value":1846},"        # error 18456: bad credentials \u002F wrong database \u002F disabled login\n",{"type":39,"tag":533,"props":1848,"children":1850},{"class":1777,"line":1849},9,[1851],{"type":39,"tag":533,"props":1852,"children":1853},{},[1854],{"type":45,"value":1855},"        raise RuntimeError(f\"Login failed (18456): {e}\")\n",{"type":39,"tag":533,"props":1857,"children":1859},{"class":1777,"line":1858},10,[1860],{"type":39,"tag":533,"props":1861,"children":1862},{},[1863],{"type":45,"value":1864},"    if 'pre-login' in msg.lower() or 'timeout' in msg.lower():\n",{"type":39,"tag":533,"props":1866,"children":1868},{"class":1777,"line":1867},11,[1869],{"type":39,"tag":533,"props":1870,"children":1871},{},[1872],{"type":45,"value":1873},"        # pre-login timeout: network path or RDS unhealthy\n",{"type":39,"tag":533,"props":1875,"children":1877},{"class":1777,"line":1876},12,[1878],{"type":39,"tag":533,"props":1879,"children":1880},{},[1881],{"type":45,"value":1882},"        raise RuntimeError(f\"Pre-login timeout: {e}\")\n",{"type":39,"tag":533,"props":1884,"children":1886},{"class":1777,"line":1885},13,[1887],{"type":39,"tag":533,"props":1888,"children":1889},{},[1890],{"type":45,"value":1891},"    raise\n",{"type":39,"tag":55,"props":1893,"children":1894},{},[1895],{"type":39,"tag":584,"props":1896,"children":1897},{},[1898],{"type":45,"value":1899},"For \"ECS Fargate auth_scheme shows NTLM instead of KERBEROS\", you MUST tell the user ALL of the following five facts:",{"type":39,"tag":1339,"props":1901,"children":1902},{},[1903,1913,1939,1961,1978],{"type":39,"tag":72,"props":1904,"children":1905},{},[1906,1911],{"type":39,"tag":584,"props":1907,"children":1908},{},[1909],{"type":45,"value":1910},"Recognize this as Kerberos falling back to NTLM, NOT a connection issue.",{"type":45,"value":1912}," The TCP connection succeeded; auth negotiation is the problem. Do NOT treat this as a security-group or DNS symptom first.",{"type":39,"tag":72,"props":1914,"children":1915},{},[1916,1921,1923,1929,1931,1937],{"type":39,"tag":584,"props":1917,"children":1918},{},[1919],{"type":45,"value":1920},"The connection string MUST use the AD-registered CNAME",{"type":45,"value":1922},", not the RDS endpoint — Kerberos requires the SPN-matching hostname. If the client connects to ",{"type":39,"tag":78,"props":1924,"children":1926},{"className":1925},[],[1927],{"type":45,"value":1928},"my-db.abc123.us-east-1.rds.amazonaws.com",{"type":45,"value":1930}," but the SPN is registered against ",{"type":39,"tag":78,"props":1932,"children":1934},{"className":1933},[],[1935],{"type":45,"value":1936},"sql.corp.example.com",{"type":45,"value":1938},", Kerberos can't match and falls back to NTLM. This is the #1 root cause.",{"type":39,"tag":72,"props":1940,"children":1941},{},[1942,1952,1954,1959],{"type":39,"tag":584,"props":1943,"children":1944},{},[1945,1947],{"type":45,"value":1946},"Verify the SPN ",{"type":39,"tag":78,"props":1948,"children":1950},{"className":1949},[],[1951],{"type":45,"value":1560},{"type":45,"value":1953}," is registered in AD — run ",{"type":39,"tag":78,"props":1955,"children":1957},{"className":1956},[],[1958],{"type":45,"value":1568},{"type":45,"value":1960}," on a domain-joined host. Missing SPN → NTLM fallback.",{"type":39,"tag":72,"props":1962,"children":1963},{},[1964,1969,1971,1976],{"type":39,"tag":584,"props":1965,"children":1966},{},[1967],{"type":45,"value":1968},"Confirm the ECS task's network path to the AD domain controllers",{"type":45,"value":1970}," on ports ",{"type":39,"tag":584,"props":1972,"children":1973},{},[1974],{"type":45,"value":1975},"53 (DNS), 88 (Kerberos), 389 (LDAP), 445 (SMB), 464 (kpasswd)",{"type":45,"value":1977},". Any missing port will silently degrade to NTLM. Kerberos DOES NOT just use 1433.",{"type":39,"tag":72,"props":1979,"children":1980},{},[1981,1986],{"type":39,"tag":584,"props":1982,"children":1983},{},[1984],{"type":45,"value":1985},"Do NOT recommend rejoining the domain or changing passwords",{"type":45,"value":1987}," until the CNAME-vs-endpoint check is confirmed. Those fixes are for different symptoms.",{"type":39,"tag":55,"props":1989,"children":1990},{},[1991],{"type":39,"tag":584,"props":1992,"children":1993},{},[1994],{"type":45,"value":1995},"For \"SSM tunnel from laptop to RDS SQL Server\", you MUST tell the user ALL of the following six facts:",{"type":39,"tag":1339,"props":1997,"children":1998},{},[1999,2022,2061,2077,2108,2126],{"type":39,"tag":72,"props":2000,"children":2001},{},[2002,2012,2014,2020],{"type":39,"tag":584,"props":2003,"children":2004},{},[2005,2006],{"type":45,"value":1623},{"type":39,"tag":78,"props":2007,"children":2009},{"className":2008},[],[2010],{"type":45,"value":2011},"aws ssm start-session",{"type":45,"value":2013}," with the document name ",{"type":39,"tag":78,"props":2015,"children":2017},{"className":2016},[],[2018],{"type":45,"value":2019},"AWS-StartPortForwardingSessionToRemoteHost",{"type":45,"value":2021}," — this is the remote-host variant, NOT the plain port-forwarding variant (which only forwards to the SSM target itself).",{"type":39,"tag":72,"props":2023,"children":2024},{},[2025,2030,2032,2038,2039,2045,2046,2052,2054,2059],{"type":39,"tag":584,"props":2026,"children":2027},{},[2028],{"type":45,"value":2029},"Document parameters:",{"type":45,"value":2031}," ",{"type":39,"tag":78,"props":2033,"children":2035},{"className":2034},[],[2036],{"type":45,"value":2037},"host=\u003Crds-endpoint>",{"type":45,"value":106},{"type":39,"tag":78,"props":2040,"children":2042},{"className":2041},[],[2043],{"type":45,"value":2044},"portNumber=1433",{"type":45,"value":106},{"type":39,"tag":78,"props":2047,"children":2049},{"className":2048},[],[2050],{"type":45,"value":2051},"localPortNumber=11433",{"type":45,"value":2053}," (use ",{"type":39,"tag":584,"props":2055,"children":2056},{},[2057],{"type":45,"value":2058},"11433 as the example",{"type":45,"value":2060},", not 1433 — a local port in the 11000s avoids conflicts with a local SQL Server instance on the laptop).",{"type":39,"tag":72,"props":2062,"children":2063},{},[2064,2075],{"type":39,"tag":584,"props":2065,"children":2066},{},[2067,2069],{"type":45,"value":2068},"Connect SSMS or sqlcmd to ",{"type":39,"tag":78,"props":2070,"children":2072},{"className":2071},[],[2073],{"type":45,"value":2074},"localhost,11433",{"type":45,"value":2076}," (SQL Server uses comma syntax, not colon).",{"type":39,"tag":72,"props":2078,"children":2079},{},[2080,2091,2093,2099,2101,2106],{"type":39,"tag":584,"props":2081,"children":2082},{},[2083,2085],{"type":45,"value":2084},"Include ",{"type":39,"tag":78,"props":2086,"children":2088},{"className":2087},[],[2089],{"type":45,"value":2090},"TrustServerCertificate=True",{"type":45,"value":2092}," in the connection string. The RDS TLS certificate is issued for the RDS endpoint hostname, but the client is connecting to ",{"type":39,"tag":78,"props":2094,"children":2096},{"className":2095},[],[2097],{"type":45,"value":2098},"localhost",{"type":45,"value":2100}," — the cert hostname won't match. ",{"type":39,"tag":78,"props":2102,"children":2104},{"className":2103},[],[2105],{"type":45,"value":2090},{"type":45,"value":2107}," skips the hostname check. Call this out explicitly as the reason.",{"type":39,"tag":72,"props":2109,"children":2110},{},[2111,2116,2118,2124],{"type":39,"tag":584,"props":2112,"children":2113},{},[2114],{"type":45,"value":2115},"Requires an intermediate EC2 instance",{"type":45,"value":2117}," with SSM Session Manager enabled (SSM agent installed, IAM instance role with ",{"type":39,"tag":78,"props":2119,"children":2121},{"className":2120},[],[2122],{"type":45,"value":2123},"AmazonSSMManagedInstanceCore",{"type":45,"value":2125},").",{"type":39,"tag":72,"props":2127,"children":2128},{},[2129,2134],{"type":39,"tag":584,"props":2130,"children":2131},{},[2132],{"type":45,"value":2133},"Security group rule on the EC2",{"type":45,"value":2135}," allowing egress to the RDS on 1433, and the RDS SG allowing inbound 1433 from the EC2's SG. The EC2 is the tunnel endpoint; the RDS must accept from the EC2.",{"type":39,"tag":48,"props":2137,"children":2139},{"id":2138},"troubleshooting",[2140],{"type":45,"value":2141},"Troubleshooting",{"type":39,"tag":61,"props":2143,"children":2145},{"id":2144},"login-failed-for-user-error-18456",[2146],{"type":45,"value":2147},"Login failed for user (error 18456)",{"type":39,"tag":55,"props":2149,"children":2150},{},[2151],{"type":45,"value":2152},"Most common cause: wrong password (state 8 in SQL Server log), wrong database (state 38\u002F40), or disabled login (state 7).",{"type":39,"tag":68,"props":2154,"children":2155},{},[2156,2161,2181],{"type":39,"tag":72,"props":2157,"children":2158},{},[2159],{"type":45,"value":2160},"Fetch current password from Secrets Manager; if the secret has been rotated, restart the app or clear the pool",{"type":39,"tag":72,"props":2162,"children":2163},{},[2164,2165,2171,2173,2179],{"type":45,"value":1505},{"type":39,"tag":78,"props":2166,"children":2168},{"className":2167},[],[2169],{"type":45,"value":2170},"SELECT * FROM sys.server_principals WHERE name = 'user'",{"type":45,"value":2172}," — check the ",{"type":39,"tag":78,"props":2174,"children":2176},{"className":2175},[],[2177],{"type":45,"value":2178},"is_disabled",{"type":45,"value":2180}," column",{"type":39,"tag":72,"props":2182,"children":2183},{},[2184,2186,2190],{"type":45,"value":2185},"See ",{"type":39,"tag":955,"props":2187,"children":2188},{"href":1165},[2189],{"type":45,"value":1165},{"type":45,"value":2191}," for the full state-code decode",{"type":39,"tag":61,"props":2193,"children":2195},{"id":2194},"cannot-generate-sspi-context",[2196],{"type":45,"value":2197},"Cannot generate SSPI context",{"type":39,"tag":55,"props":2199,"children":2200},{},[2201],{"type":45,"value":2202},"Windows authentication with Kerberos handshake failure. Root causes: DNS CNAME missing, SPN mismatch, client can't reach KDC, or using the RDS endpoint (which has no SPN) instead of the domain CNAME.",{"type":39,"tag":68,"props":2204,"children":2205},{},[2206,2219,2224],{"type":39,"tag":72,"props":2207,"children":2208},{},[2209,2211,2217],{"type":45,"value":2210},"Verify the CNAME ",{"type":39,"tag":78,"props":2212,"children":2214},{"className":2213},[],[2215],{"type":45,"value":2216},"\u003Cdb-instance-identifier>.\u003Cdomain-fqdn>",{"type":45,"value":2218}," resolves from the client",{"type":39,"tag":72,"props":2220,"children":2221},{},[2222],{"type":45,"value":2223},"Check SPN exists in AD for the CNAME",{"type":39,"tag":72,"props":2225,"children":2226},{},[2227,2228],{"type":45,"value":2185},{"type":39,"tag":955,"props":2229,"children":2230},{"href":1101},[2231],{"type":45,"value":1101},{"type":39,"tag":61,"props":2233,"children":2235},{"id":2234},"auth_scheme-shows-ntlm-instead-of-kerberos",[2236],{"type":45,"value":2237},"auth_scheme shows NTLM instead of KERBEROS",{"type":39,"tag":55,"props":2239,"children":2240},{},[2241],{"type":45,"value":2242},"Kerberos fell back to NTLM. Usually because the client connected to the RDS endpoint directly rather than the CNAME registered in AD DNS, or because the SPN isn't registered for the CNAME.",{"type":39,"tag":68,"props":2244,"children":2245},{},[2246,2259,2270],{"type":39,"tag":72,"props":2247,"children":2248},{},[2249,2251,2257],{"type":45,"value":2250},"Connect to the CNAME (e.g. ",{"type":39,"tag":78,"props":2252,"children":2254},{"className":2253},[],[2255],{"type":45,"value":2256},"database-1.example.com",{"type":45,"value":2258},") not the RDS endpoint",{"type":39,"tag":72,"props":2260,"children":2261},{},[2262,2264],{"type":45,"value":2263},"Verify with ",{"type":39,"tag":78,"props":2265,"children":2267},{"className":2266},[],[2268],{"type":45,"value":2269},"SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID",{"type":39,"tag":72,"props":2271,"children":2272},{},[2273,2274],{"type":45,"value":2185},{"type":39,"tag":955,"props":2275,"children":2276},{"href":1165},[2277],{"type":45,"value":1165},{"type":39,"tag":61,"props":2279,"children":2281},{"id":2280},"connection-timeout",[2282],{"type":45,"value":2283},"Connection timeout",{"type":39,"tag":55,"props":2285,"children":2286},{},[2287],{"type":45,"value":2288},"Network path blocked. Check in order:",{"type":39,"tag":1339,"props":2290,"children":2291},{},[2292,2297,2302,2307,2320],{"type":39,"tag":72,"props":2293,"children":2294},{},[2295],{"type":45,"value":2296},"Security group inbound on 1433 from the client SG (same VPC) or CIDR (cross-VPC)",{"type":39,"tag":72,"props":2298,"children":2299},{},[2300],{"type":45,"value":2301},"Route table has a route to RDS (TGW attachment or peering)",{"type":39,"tag":72,"props":2303,"children":2304},{},[2305],{"type":45,"value":2306},"NACL isn't blocking return traffic",{"type":39,"tag":72,"props":2308,"children":2309},{},[2310,2312,2318],{"type":45,"value":2311},"RDS instance is in ",{"type":39,"tag":78,"props":2313,"children":2315},{"className":2314},[],[2316],{"type":45,"value":2317},"available",{"type":45,"value":2319}," state",{"type":39,"tag":72,"props":2321,"children":2322},{},[2323],{"type":45,"value":2324},"For Lambda in VPC: NAT gateway or VPC endpoint for Secrets Manager\u002FSTS",{"type":39,"tag":61,"props":2326,"children":2328},{"id":2327},"certificate-validation-errors",[2329],{"type":45,"value":2330},"Certificate validation errors",{"type":39,"tag":55,"props":2332,"children":2333},{},[2334,2336,2342,2344,2350,2352,2358],{"type":45,"value":2335},"Client doesn't trust the RDS CA chain. Download ",{"type":39,"tag":78,"props":2337,"children":2339},{"className":2338},[],[2340],{"type":45,"value":2341},"global-bundle.pem",{"type":45,"value":2343}," from RDS truststore and add to the client truststore (Java) or ",{"type":39,"tag":78,"props":2345,"children":2347},{"className":2346},[],[2348],{"type":45,"value":2349},"TrustedCAs",{"type":45,"value":2351}," (.NET) or ",{"type":39,"tag":78,"props":2353,"children":2355},{"className":2354},[],[2356],{"type":45,"value":2357},"SSL_SERVER_CA",{"type":45,"value":2359}," (Python).",{"type":39,"tag":61,"props":2361,"children":2363},{"id":2362},"access-denied-to-secrets-manager-from-lambda",[2364],{"type":45,"value":2365},"Access denied to Secrets Manager from Lambda",{"type":39,"tag":55,"props":2367,"children":2368},{},[2369,2371,2377,2379,2385],{"type":45,"value":2370},"Lambda in VPC has no internet access by default. Either create a VPC endpoint for Secrets Manager or add a NAT gateway. Lambda execution role needs ",{"type":39,"tag":78,"props":2372,"children":2374},{"className":2373},[],[2375],{"type":45,"value":2376},"secretsmanager:GetSecretValue",{"type":45,"value":2378}," (and ",{"type":39,"tag":78,"props":2380,"children":2382},{"className":2381},[],[2383],{"type":45,"value":2384},"kms:Decrypt",{"type":45,"value":2386}," if customer-managed KMS).",{"type":39,"tag":61,"props":2388,"children":2390},{"id":2389},"ssms-a-connection-was-successfully-established-with-the-server-but-then-an-error-occurred-during-the-pre-login-handshake",[2391],{"type":45,"value":2392},"SSMS \"A connection was successfully established with the server, but then an error occurred during the pre-login handshake\"",{"type":39,"tag":55,"props":2394,"children":2395},{},[2396],{"type":45,"value":2397},"TLS version mismatch. SSMS \u003C 18 uses TLS 1.0; RDS SQL Server requires TLS 1.2+. Upgrade SSMS or apply the TLS 1.2 patch.",{"type":39,"tag":61,"props":2399,"children":2401},{"id":2400},"pymssql-importerror-dll-load-failed-on-windows",[2402],{"type":45,"value":2403},"pymssql ImportError: DLL load failed on Windows",{"type":39,"tag":55,"props":2405,"children":2406},{},[2407,2409,2414,2416,2422,2423,2429],{"type":45,"value":2408},"Missing FreeTDS. Use ",{"type":39,"tag":78,"props":2410,"children":2412},{"className":2411},[],[2413],{"type":45,"value":1308},{"type":45,"value":2415}," on Windows instead — it uses the native ",{"type":39,"tag":78,"props":2417,"children":2419},{"className":2418},[],[2420],{"type":45,"value":2421},"SQL Server Native Client",{"type":45,"value":1489},{"type":39,"tag":78,"props":2424,"children":2426},{"className":2425},[],[2427],{"type":45,"value":2428},"ODBC Driver 18 for SQL Server",{"type":45,"value":841},{"type":39,"tag":48,"props":2431,"children":2433},{"id":2432},"additional-resources",[2434],{"type":45,"value":2435},"Additional Resources",{"type":39,"tag":68,"props":2437,"children":2438},{},[2439,2456,2471,2486,2501,2516,2531,2546,2561,2575],{"type":39,"tag":72,"props":2440,"children":2441},{},[2442,2447,2449],{"type":39,"tag":584,"props":2443,"children":2444},{},[2445],{"type":45,"value":2446},"AWS RDS for SQL Server User Guide",{"type":45,"value":2448},": ",{"type":39,"tag":955,"props":2450,"children":2454},{"href":2451,"rel":2452},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FCHAP_SQLServer.html",[2453],"nofollow",[2455],{"type":45,"value":2451},{"type":39,"tag":72,"props":2457,"children":2458},{},[2459,2464,2465],{"type":39,"tag":584,"props":2460,"children":2461},{},[2462],{"type":45,"value":2463},"RDS SQL Server TLS\u002FSSL",{"type":45,"value":2448},{"type":39,"tag":955,"props":2466,"children":2469},{"href":2467,"rel":2468},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FSQLServer.Concepts.General.SSL.Using.html",[2453],[2470],{"type":45,"value":2467},{"type":39,"tag":72,"props":2472,"children":2473},{},[2474,2479,2480],{"type":39,"tag":584,"props":2475,"children":2476},{},[2477],{"type":45,"value":2478},"AWS Managed Microsoft AD with RDS",{"type":45,"value":2448},{"type":39,"tag":955,"props":2481,"children":2484},{"href":2482,"rel":2483},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002FUSER_SQLServerWinAuth.html",[2453],[2485],{"type":45,"value":2482},{"type":39,"tag":72,"props":2487,"children":2488},{},[2489,2494,2495],{"type":39,"tag":584,"props":2490,"children":2491},{},[2492],{"type":45,"value":2493},"RDS Proxy for SQL Server",{"type":45,"value":2448},{"type":39,"tag":955,"props":2496,"children":2499},{"href":2497,"rel":2498},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonRDS\u002Flatest\u002FUserGuide\u002Frds-proxy.html",[2453],[2500],{"type":45,"value":2497},{"type":39,"tag":72,"props":2502,"children":2503},{},[2504,2509,2510],{"type":39,"tag":584,"props":2505,"children":2506},{},[2507],{"type":45,"value":2508},"Microsoft.Data.SqlClient",{"type":45,"value":2448},{"type":39,"tag":955,"props":2511,"children":2514},{"href":2512,"rel":2513},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsql\u002Fconnect\u002Fado-net\u002Fmicrosoft-ado-net-sql-server",[2453],[2515],{"type":45,"value":2512},{"type":39,"tag":72,"props":2517,"children":2518},{},[2519,2524,2525],{"type":39,"tag":584,"props":2520,"children":2521},{},[2522],{"type":45,"value":2523},"mssql-jdbc driver",{"type":45,"value":2448},{"type":39,"tag":955,"props":2526,"children":2529},{"href":2527,"rel":2528},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fsql\u002Fconnect\u002Fjdbc\u002Fmicrosoft-jdbc-driver-for-sql-server",[2453],[2530],{"type":45,"value":2527},{"type":39,"tag":72,"props":2532,"children":2533},{},[2534,2539,2540],{"type":39,"tag":584,"props":2535,"children":2536},{},[2537],{"type":45,"value":2538},"pymssql documentation",{"type":45,"value":2448},{"type":39,"tag":955,"props":2541,"children":2544},{"href":2542,"rel":2543},"https:\u002F\u002Fwww.pymssql.org\u002F",[2453],[2545],{"type":45,"value":2542},{"type":39,"tag":72,"props":2547,"children":2548},{},[2549,2554,2555],{"type":39,"tag":584,"props":2550,"children":2551},{},[2552],{"type":45,"value":2553},"tedious (Node.js)",{"type":45,"value":2448},{"type":39,"tag":955,"props":2556,"children":2559},{"href":2557,"rel":2558},"https:\u002F\u002Ftediousjs.github.io\u002Ftedious\u002F",[2453],[2560],{"type":45,"value":2557},{"type":39,"tag":72,"props":2562,"children":2563},{},[2564,2569,2570],{"type":39,"tag":584,"props":2565,"children":2566},{},[2567],{"type":45,"value":2568},"RDS CA bundle",{"type":45,"value":2448},{"type":39,"tag":955,"props":2571,"children":2573},{"href":1254,"rel":2572},[2453],[2574],{"type":45,"value":1254},{"type":39,"tag":72,"props":2576,"children":2577},{},[2578,2583,2584,2590,2591,2597,2598,2604],{"type":39,"tag":584,"props":2579,"children":2580},{},[2581],{"type":45,"value":2582},"Related skills",{"type":45,"value":2448},{"type":39,"tag":78,"props":2585,"children":2587},{"className":2586},[],[2588],{"type":45,"value":2589},"rds-oracle",{"type":45,"value":106},{"type":39,"tag":78,"props":2592,"children":2594},{"className":2593},[],[2595],{"type":45,"value":2596},"rds-db2",{"type":45,"value":106},{"type":39,"tag":78,"props":2599,"children":2601},{"className":2600},[],[2602],{"type":45,"value":2603},"amazon-aurora",{"type":45,"value":2605}," (for cross-engine comparison)",{"type":39,"tag":48,"props":2607,"children":2609},{"id":2608},"handoff-from-aws-database-selection",[2610],{"type":45,"value":2611},"Handoff from aws-database-selection",{"type":39,"tag":55,"props":2613,"children":2614},{},[2615,2617,2623,2625,2631,2633,2639,2641,2647],{"type":45,"value":2616},"This skill can be invoked directly, or it can be entered from the ",{"type":39,"tag":78,"props":2618,"children":2620},{"className":2619},[],[2621],{"type":45,"value":2622},"aws-database-selection",{"type":45,"value":2624}," parent skill after that skill has run a requirements interview and produced a ",{"type":39,"tag":78,"props":2626,"children":2628},{"className":2627},[],[2629],{"type":45,"value":2630},"requirements.json",{"type":45,"value":2632}," artifact. When you see a backtick-wrapped path matching ",{"type":39,"tag":78,"props":2634,"children":2636},{"className":2635},[],[2637],{"type":45,"value":2638},"aws_dbs_requirements\u002F*\u002Frequirements.json",{"type":45,"value":2640}," in recent conversation, follow the entry protocol in ",{"type":39,"tag":78,"props":2642,"children":2644},{"className":2643},[],[2645],{"type":45,"value":2646},"aws-database-selection\u002Freferences\u002Fhandoff-contract.md",{"type":45,"value":2648},":",{"type":39,"tag":1339,"props":2650,"children":2651},{},[2652,2664,2677,2689,2723],{"type":39,"tag":72,"props":2653,"children":2654},{},[2655,2657,2663],{"type":45,"value":2656},"Read the artifact using ",{"type":39,"tag":78,"props":2658,"children":2660},{"className":2659},[],[2661],{"type":45,"value":2662},"file_read",{"type":45,"value":841},{"type":39,"tag":72,"props":2665,"children":2666},{},[2667,2669,2675],{"type":45,"value":2668},"Validate it against ",{"type":39,"tag":78,"props":2670,"children":2672},{"className":2671},[],[2673],{"type":45,"value":2674},"aws-database-selection\u002Freferences\u002Fworkload-primary-artifact.schema.json",{"type":45,"value":2676},". If malformed or unreadable, tell the user and proceed without it.",{"type":39,"tag":72,"props":2678,"children":2679},{},[2680,2682,2687],{"type":45,"value":2681},"Acknowledge what's relevant in one or two ",{"type":39,"tag":584,"props":2683,"children":2684},{},[2685],{"type":45,"value":2686},"bold",{"type":45,"value":2688}," sentences, citing high-level facts from the artifact (dominant shapes, hard constraints, migration context) — do not parrot the entire artifact back.",{"type":39,"tag":72,"props":2690,"children":2691},{},[2692,2694,2700,2701,2707,2709,2714,2716,2721],{"type":45,"value":2693},"Scope-check: this skill is scoped to Amazon RDS for SQL Server connectivity, authentication (SSPI, Kerberos, SPN, AWS Managed Microsoft AD), and client deployment patterns. If the artifact's ",{"type":39,"tag":78,"props":2695,"children":2697},{"className":2696},[],[2698],{"type":45,"value":2699},"workload_primaries.dominant_shapes",{"type":45,"value":1489},{"type":39,"tag":78,"props":2702,"children":2704},{"className":2703},[],[2705],{"type":45,"value":2706},"migration_context",{"type":45,"value":2708}," don't match that scope, emit weak backpressure per the handoff contract: suggest ",{"type":39,"tag":78,"props":2710,"children":2712},{"className":2711},[],[2713],{"type":45,"value":2603},{"type":45,"value":2715}," for refactor-to-PostgreSQL from SQL Server, or go back to ",{"type":39,"tag":78,"props":2717,"children":2719},{"className":2718},[],[2720],{"type":45,"value":2622},{"type":45,"value":2722}," if SQL Server isn't the source, then ask the user whether to go back or proceed anyway. Do not silently misuse the artifact.",{"type":39,"tag":72,"props":2724,"children":2725},{},[2726],{"type":45,"value":2727},"Proceed with this skill's native workflow, citing artifact paths as evidence when recommendations are grounded in the requirements.",{"type":39,"tag":55,"props":2729,"children":2730},{},[2731],{"type":45,"value":2732},"All user-facing output from this skill follows the markdown-primitives-only formatting convention in the handoff contract: bold labels, backticks for paths and enum values, bullet lists for alternatives, no ASCII art or box-drawing characters.",{"type":39,"tag":2734,"props":2735,"children":2736},"style",{},[2737],{"type":45,"value":2738},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2740,"total":2844},[2741,2758,2773,2788,2803,2813,2828],{"slug":2742,"name":2742,"fn":2743,"description":2744,"org":2745,"tags":2746,"stars":21,"repoUrl":22,"updatedAt":2757},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2747,2750,2753,2754],{"name":2748,"slug":2749,"type":15},"Agents","agents",{"name":2751,"slug":2752,"type":15},"Automation","automation",{"name":20,"slug":8,"type":15},{"name":2755,"slug":2756,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":2759,"name":2759,"fn":2760,"description":2761,"org":2762,"tags":2763,"stars":21,"repoUrl":22,"updatedAt":2772},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2764,2765,2768,2771],{"name":2748,"slug":2749,"type":15},{"name":2766,"slug":2767,"type":15},"API Development","api-development",{"name":2769,"slug":2770,"type":15},"Authentication","authentication",{"name":20,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":2774,"name":2774,"fn":2775,"description":2776,"org":2777,"tags":2778,"stars":21,"repoUrl":22,"updatedAt":2787},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2779,2780,2781,2784],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2782,"slug":2783,"type":15},"Debugging","debugging",{"name":2785,"slug":2786,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":2789,"name":2789,"fn":2790,"description":2791,"org":2792,"tags":2793,"stars":21,"repoUrl":22,"updatedAt":2802},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2794,2795,2796,2799],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2797,"slug":2798,"type":15},"CI\u002FCD","ci-cd",{"name":2800,"slug":2801,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":2804,"name":2804,"fn":2805,"description":2806,"org":2807,"tags":2808,"stars":21,"repoUrl":22,"updatedAt":2812},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2809,2810,2811],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2800,"slug":2801,"type":15},"2026-07-12T08:42:51.963247",{"slug":2814,"name":2814,"fn":2815,"description":2816,"org":2817,"tags":2818,"stars":21,"repoUrl":22,"updatedAt":2827},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2819,2820,2821,2824],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2822,"slug":2823,"type":15},"Best Practices","best-practices",{"name":2825,"slug":2826,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":2829,"name":2829,"fn":2830,"description":2831,"org":2832,"tags":2833,"stars":21,"repoUrl":22,"updatedAt":2843},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2834,2835,2836,2839,2840],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2837,"slug":2838,"type":15},"Evals","evals",{"name":2785,"slug":2786,"type":15},{"name":2841,"slug":2842,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",114,{"items":2846,"total":2961},[2847,2854,2861,2868,2875,2881,2888,2896,2911,2924,2936,2951],{"slug":2742,"name":2742,"fn":2743,"description":2744,"org":2848,"tags":2849,"stars":21,"repoUrl":22,"updatedAt":2757},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2850,2851,2852,2853],{"name":2748,"slug":2749,"type":15},{"name":2751,"slug":2752,"type":15},{"name":20,"slug":8,"type":15},{"name":2755,"slug":2756,"type":15},{"slug":2759,"name":2759,"fn":2760,"description":2761,"org":2855,"tags":2856,"stars":21,"repoUrl":22,"updatedAt":2772},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2857,2858,2859,2860],{"name":2748,"slug":2749,"type":15},{"name":2766,"slug":2767,"type":15},{"name":2769,"slug":2770,"type":15},{"name":20,"slug":8,"type":15},{"slug":2774,"name":2774,"fn":2775,"description":2776,"org":2862,"tags":2863,"stars":21,"repoUrl":22,"updatedAt":2787},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2864,2865,2866,2867],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2782,"slug":2783,"type":15},{"name":2785,"slug":2786,"type":15},{"slug":2789,"name":2789,"fn":2790,"description":2791,"org":2869,"tags":2870,"stars":21,"repoUrl":22,"updatedAt":2802},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2871,2872,2873,2874],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2797,"slug":2798,"type":15},{"name":2800,"slug":2801,"type":15},{"slug":2804,"name":2804,"fn":2805,"description":2806,"org":2876,"tags":2877,"stars":21,"repoUrl":22,"updatedAt":2812},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2878,2879,2880],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2800,"slug":2801,"type":15},{"slug":2814,"name":2814,"fn":2815,"description":2816,"org":2882,"tags":2883,"stars":21,"repoUrl":22,"updatedAt":2827},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2884,2885,2886,2887],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2822,"slug":2823,"type":15},{"name":2825,"slug":2826,"type":15},{"slug":2829,"name":2829,"fn":2830,"description":2831,"org":2889,"tags":2890,"stars":21,"repoUrl":22,"updatedAt":2843},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2891,2892,2893,2894,2895],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2837,"slug":2838,"type":15},{"name":2785,"slug":2786,"type":15},{"name":2841,"slug":2842,"type":15},{"slug":2897,"name":2897,"fn":2898,"description":2899,"org":2900,"tags":2901,"stars":21,"repoUrl":22,"updatedAt":2910},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2902,2903,2904,2907],{"name":20,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":2905,"slug":2906,"type":15},"MySQL","mysql",{"name":2908,"slug":2909,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":2912,"name":2912,"fn":2913,"description":2914,"org":2915,"tags":2916,"stars":21,"repoUrl":22,"updatedAt":2923},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2917,2918,2919,2922],{"name":20,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":2920,"slug":2921,"type":15},"PostgreSQL","postgresql",{"name":2908,"slug":2909,"type":15},"2026-07-16T06:00:34.789624",{"slug":2925,"name":2925,"fn":2926,"description":2927,"org":2928,"tags":2929,"stars":21,"repoUrl":22,"updatedAt":2935},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2930,2931,2932],{"name":2748,"slug":2749,"type":15},{"name":20,"slug":8,"type":15},{"name":2933,"slug":2934,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":2937,"name":2937,"fn":2938,"description":2939,"org":2940,"tags":2941,"stars":21,"repoUrl":22,"updatedAt":2950},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2942,2943,2944,2947],{"name":20,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":2945,"slug":2946,"type":15},"MongoDB","mongodb",{"name":2948,"slug":2949,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":2952,"name":2952,"fn":2953,"description":2954,"org":2955,"tags":2956,"stars":21,"repoUrl":22,"updatedAt":2960},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2957,2958,2959],{"name":20,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"name":2948,"slug":2949,"type":15},"2026-07-16T06:00:37.690386",115]