AWS Aurora Python Integration

Use asyncpg for queries, boto3 for IAM auth token generation, and the Vercel Python SDK for OIDC token retrieval. On Vercel, AWS credentials are obtained via OIDC federation: call get_vercel_oidc_token() from vercel.oidc.aio, then exchange that token for temporary AWS credentials via sts.assume_role_with_web_identity(). Do not rely on VERCEL_OIDC_TOKEN as an environment variable; it is not available in production runtime.

Guidelines

• Use asyncpg.create_pool() with the IAM token as the password. Async access avoids blocking FastAPI's event loop.
• Authenticate via OIDC: call get_vercel_oidc_token() to get the Vercel OIDC token, pass it to sts.assume_role_with_web_identity() to get temporary credentials, then use those credentials with rds.generate_db_auth_token().
• Use $1, $2 parameter syntax for queries (asyncpg's native format). Never use f-strings for SQL.
• Enable SSL (ssl="require") — IAM auth requires an encrypted connection.
• Wrap route handlers in try/except and return clear error JSON. Unhandled errors get buried in deep ASGI stack traces and could lead you in the wrong direction.

Aurora DSQL Restrictions

If the target is Aurora DSQL (not standard Aurora PostgreSQL), these PostgreSQL features are not available: