/rds-db2

name: rds-db2
version: 2
description: Provisions, connects, migrates, and operates Amazon RDS for Db2. Applies when provisioning with IBM customer and site IDs (License Manager, BYOL, GovCloud), connecting over TLS, fixing SQL30082N after Secrets Manager rotation, migration from Db2 LUW (Linux, AIX, Windows, AS400) or z/OS mainframe (ADB2GEN, Q Replication), choosing code page/collation (EBCDIC, CCSID), S3 backup/restore, Multi-AZ and cross-region standby replicas, RDSADMIN procedures, customer-managed KMS BYOK, self-managed Active Directory Kerberos, Db2 audit to S3, minimum IAM, or colocation.

Amazon RDS for Db2

Overview

Amazon RDS for Db2 is a managed IBM Db2 LUW service. RDS for Db2 is managed — you cannot SSH to the host, install agents, or run unfenced external stored procedures in C/COBOL. Java stored procedures work via `sqlj.install_jar`. This skill covers the operator lifecycle: provisioning with IBM licensing, client install and TLS connectivity, migration from self-managed Db2 on Linux/AIX/Windows/z/OS/AS400, S3 backup and restore, Multi-AZ and cross-region standby replicas, and RDSADMIN stored procedures that replace SYSCTRL/SYSMAINT authority.

It also covers six additional security and operations areas: customer-managed KMS keys (BYOK), self-managed Active Directory with Kerberos authentication, Db2 audit to S3, code page and collation selection (EBCDIC, CCSID), minimum IAM permissions, and EC2/RDS colocation for Multi-AZ latency and failover.

The AWS MCP server is recommended but not required; all operations are expressed in AWS CLI syntax and run with or without it.

Routes to the matching sub-skill reference. Load only the matching reference.

Common Tasks

Verify Dependencies

Before executing an RDS for Db2 workflow, confirm required tools exist. Do not run installers or API calls yet.

• AWS CLI v2 for every RDS API call
• AWS credentials via managed mechanism (IAM role, instance profile, `ada credentials update`) — not pasted credentials
• Client install: `bash`/`curl` access, run as root and as `db2inst1`
• Airgap install: internet-connected machine + target with VPC endpoints for S3, SSM, Secrets Manager
• Mainframe migration: z/OS access, IBM ADB2GEN license, Python 3
• BYOK / customer-managed KMS: `openssl` (to wrap imported key material) and `jq` (to parse `get-parameters-for-import` output)
• Self-managed Active Directory + Kerberos: `realmd`, `sssd`, `adcli`, `krb5-workstation` on the client, plus a valid Kerberos ticket (`kinit` produces a TGT — check with `klist`)
• Kerberos JDBC test: a JDK and the Db2 JDBC driver `db2jcc4.jar` v4.33+ (earlier driver versions lack `securityMechanism=11` Kerberos support)

**Constraints:**

• The agent MUST check dependencies before running any install or AWS API command.
• The agent MUST NOT prompt the user to paste credentials because credentials MUST flow through an IAM role or instance profile.
• The agent MUST tell the user which dependencies are missing and MUST respect the user's decision to abort.
• The agent MUST explain, for each step, what it does, why, and which tool will be invoked — before invoking it.

Classify and Route

Map the user's question to the correct sub-skill reference, then load only that file.

| User says | Sub-skill | Load | |---|---|---| | create / provision / parameter group / IBM customer ID / IBM site ID / License Manager / BYOL / GovCloud | provisioning | [provisioning.md](references/provisioning.md) | | connect / SQL30082N / SQL1531N / DSN / CLP / Python / Java / CloudShell / airgap | connectivity | [connectivity.md](references/connectivity.md) | | SSL / TLS / GSKit / certificate / truststore / bundle.pem | connectivity-tls | [connectivity-tls.md](references/connectivity-tls.md) | | Python driver / JDBC / laptop / multi-instance / db2_use | connection drivers | [connection-drivers.md](references/connection-drivers.md) | | migrate / DMS / Q Replication / IIDR / AIX / Windows / AS400 / precheck | migration | [migration.md](references/migration.md) | | z/OS / mainframe / ADB2GEN / schema conversion | mainframe-migration | [mainframe-migration.md](references/mainframe-migration.md) | | code page / collation / CCSID / EBCDIC / UTF-8 / CODEUNITS32 / territory | code page & collation | [code-page-collation.md](references/code-page-collation.md) | | snapshot / backup / restore / rollforward / PiTR / S3 integration | backup-restore | [backup-restore.md](references/backup-restore.md) | | Multi-AZ / standby replica / read replica / HADR / cross-region / failover | ha-dr | [ha-dr.md](references/ha-dr.md) | | parameter group / RDSADMIN / scale / storage / CloudWatch / registry variable | operations | [operations.md](references/operations.md) | | BYOK / customer-managed KMS / bring your own key / imported key material / multi-region key | byok | [byok-kms.md](references/byok-kms.md) | | Active Directory / Kerberos / domain join / self-managed AD / kinit / SPN / realm | ad-kerberos | [ad-kerberos.md](references/ad-kerberos.md) | | audit / DB2_AUDIT / audit policy / audit to S3 / option group | db2-audit | [db2-audit.md](references/db2-audit.md) | | minimum IAM / least privilege / IAM policy / trust policy / permissions | minimum-iam | [minimum-iam.md](references/minimum-iam.md) | | colocation / co-locate / EC2 app latency / ASG / ALB / failover routing | colocation | [colocation.md](references/colocation.md) |

**Constraints:**

• The agent MUST read only the reference files that match the user's question, to keep the context focused.
• The agent MUST NOT invent RDSADMIN procedure signatures, because wrong parameter order will fail at runtime — always cite the signature from the reference file.
• The agent MUST cite the source blog URL when an answer is blog-sourced, so the user can verify specifics.
• If a question crosses two sub-skills (e.g. "migrate z/OS with near-zero downtime", or "BYOK plus cross-region standby"), the agent SHOULD load each matching reference and combin