Connect Amazon RDS to Excel, Sheets and AI

One card, four engines

RDS is not one database, it is a billing envelope around several. The card treats it that way: pick the engine and the form becomes that engine's form, then the connection is saved as that engine rather than as something called “RDS”.

• PostgreSQL and Aurora PostgreSQL on 5432, MySQL and Aurora MySQL on 3306, MariaDB on 3306, SQL Server on 1433. The port field prefills for the engine you chose and can be overridden.
• The field labels follow the engine — SQL Server asks for a Server, the other three ask for an Endpoint — because that is the word each community actually uses.
• TLS is a checkbox for the three open-source engines and is on by default, which is what an instance with rds.force_ssl set requires. SQL Server on RDS takes its encryption from the instance instead — set rds.force_ssl on its parameter group if you want it guaranteed.
• Oracle on RDS is the one exception: use the Oracle card for it. The connection is still recognised as RDS afterwards and still carries the RDS badge — the engine picker simply does not offer it.

Aurora clusters are read correctly

An Aurora endpoint is not an instance address, and treating it like one is how people accidentally point reporting at a writer.

• A cluster endpoint is recognised by the .cluster- infix in the hostname, and the card says so as soon as it appears.
• The writer endpoint routes to the current writer on its own, so a failover does not leave a saved connection pointing at an instance that is no longer in charge.
• Reader endpoints are read-only replicas, which is exactly what a reporting connection should be aimed at. Query Streams only ever issues reads, so a reader endpoint costs you nothing and keeps the load off the writer.

The private path is the intended one

Most guides for getting RDS data into a spreadsheet quietly begin with making the instance publicly accessible. This one does not, and it is worth being explicit about why.

• The agent makes outbound connections only. It never listens, so putting it inside the VPC costs no inbound rule and no security-group change on the database.
• Publicly accessible can stay off, the subnet can stay private, and there is no IP allow-list to keep in step with anyone's home broadband.
• If the instance is already reachable over a public endpoint you allow, that works too — the agent does not care which side of the boundary it is on, only that it can open one connection.

-- One reader, four engines, same statement shape
SELECT   c.name,
         COUNT(o.id)   AS orders,
         SUM(o.amount) AS revenue
FROM     customers AS c
JOIN     orders    AS o ON o.customer_id = c.id
WHERE    o.placed_at >= CURRENT_DATE - INTERVAL '30' DAY
GROUP BY c.name
ORDER BY revenue DESC;