Rds Db2

Amazon RDS for Db2

Overview

Amazon RDS for Db2 is a managed IBM Db2 LUW service. RDS for Db2 is managed — you cannot SSH to the host, install agents, or run unfenced external stored procedures in C/COBOL. Java stored procedures work via sqlj.install_jar. This skill covers the operator lifecycle: provisioning with IBM licensing, client install and TLS connectivity, migration from self-managed Db2 on Linux/AIX/Windows/z/OS/AS400, S3 backup and restore, Multi-AZ and cross-region standby replicas, and RDSADMIN stored procedures that replace SYSCTRL/SYSMAINT authority.

It also covers six additional security and operations areas: customer-managed KMS keys (BYOK), self-managed Active Directory with Kerberos authentication, Db2 audit to S3, code page and collation selection (EBCDIC, CCSID), minimum IAM permissions, and EC2/RDS colocation for Multi-AZ latency and failover.

The AWS MCP server is recommended but not required; all operations are expressed in AWS CLI syntax and run with or without it.

Routes to the matching sub-skill reference. Load only the matching reference.

Common Tasks

Verify Dependencies

Before executing an RDS for Db2 workflow, confirm required tools exist. Do not run installers or API calls yet.

• AWS CLI v2 for every RDS API call
• AWS credentials via managed mechanism (IAM role, instance profile, ada credentials update) — not pasted credentials
• Client install: bash/curl access, run as root and as db2inst1
• Airgap install: internet-connected machine + target with VPC endpoints for S3, SSM, Secrets Manager
• Mainframe migration: z/OS access, IBM ADB2GEN license, Python 3
• BYOK / customer-managed KMS: openssl (to wrap imported key material) and jq (to parse get-parameters-for-import output)
• Self-managed Active Directory + Kerberos: realmd, sssd, adcli, krb5-workstation on the client, plus a valid Kerberos ticket (kinit produces a TGT — check with klist)
• Kerberos JDBC test: a JDK and the Db2 JDBC driver db2jcc4.jar v4.33+ (earlier driver versions lack securityMechanism=11 Kerberos support)

Constraints:

• The agent MUST check dependencies before running any install or AWS API command.
• The agent MUST NOT prompt the user to paste credentials because credentials MUST flow through an IAM role or instance profile.
• The agent MUST tell the user which dependencies are missing and MUST respect the user's decision to abort.
• The agent MUST explain, for each step, what it does, why, and which tool will be invoked — before invoking it.

Classify and Route

Map the user's question to the correct sub-skill reference, then load only that file.

Constraints:

• The agent MUST read only the reference files that match the user's question, to keep the context focused.
• The agent MUST NOT invent RDSADMIN procedure signatures, because wrong parameter order will fail at runtime — always cite the signature from the reference file.
• The agent MUST cite the source blog URL when an answer is blog-sourced, so the user can verify specifics.
• If a question crosses two sub-skills (e.g. "migrate z/OS with near-zero downtime", or "BYOK plus cross-region standby"), the agent SHOULD load each matching reference and combine them.

Execute Workflow

Once routed, give the user a concrete, runnable answer grounded in the reference file.

Parameter acquisition:

• All required parameters (region, instance identifier, source/target ARNs, S3 bucket, prefix, the --master-username value) MUST be collected upfront in a single message.
• Parameter formats MUST be specified: region us-east-1-style; instance identifier ^[a-zA-Z][a-zA-Z0-9-]{0,62}$; ARN arn:aws:rds:<region>:<account>:db:<name>; S3 bucket 3–63 chars lowercase.
• The agent MUST accept parameters via direct input, a JSON/YAML file path, or a URL.

Tool use:

• Use AWS CLI for RDS operations (example: aws rds create-db-instance-read-replica --db-instance-identifier <name> --source-db-instance-identifier <arn> --replica-mode mounted --region <dr-region>). Every operation is expressed in AWS CLI syntax so it runs whether or not the AWS MCP server is installed.
• Use bundled scripts — db2-driver.sh, db2client-configure.sh, db2client-airgap.sh, functions.sh — instead of rewriting install steps.
• Write migration plans, upgrade plans, validation reports to a local artifacts/<app-name>/ directory created at runtime in the working directory (this is a run-time output location, not part of the shipped skill).

Constraints:

• The agent MUST give exact CLI commands when behavior is deterministic, not descriptions like "enable Multi-AZ".
• The agent MUST obtain AWS credentials through an IAM role or instance profile and MUST NOT prompt the user to paste credentials.
• The agent MUST cite the source blog or documentation URL whenever the answer is sourced from published material, so the user can verify it.
• The agent MUST write long-form artifacts to a local artifacts/<app-name>/ directory (created at runtime in the working directory) so the workspace is inspectable.
• When a requested action is unsupported on managed RDS for Db2, the agent MUST state the limitation plainly — no hedging like "limited support" or "with special config" — and offer a supported alternative (for example, unfenced C/COBOL stored procedures are not supported; rewrite them in Java via sqlj.install_jar, or in SQL PL).