Amazon RDS for PostgreSQL + CHION

Amazon RDS Postgres text-to-SQL
that shows the SELECT under each chart

On AWS the build-it-yourself path runs Bedrock behind a LangChain chain on ECS or Fargate, and the prompt and the guardrail stay yours to maintain. That route wins when you want your own model inside your own account. Chion is Amazon RDS Postgres text-to-SQL instead. It connects to your reader endpoint through a read-only role you create, turns "monthly revenue for the last 6 months?" into a SELECT that passes the application validators, and prints the executed query under the chart.

Read-only SELECT against your RDS instance or Aurora reader endpoint
Saved queries compiled for Claude Code and Codex

The executed SELECT is printed beneath every chart, line by line.

Start your 7-day trial Read the connection guide

Ask a question against your RDS reader endpoint and read the executed SELECT beneath the chart, without managing a single container.

Chion turns your Amazon RDS or Aurora PostgreSQL into an analyst your team can question in plain English. Each answer carries the SELECT that produced it, and a follow-up refines the same query. Point it at the Aurora reader endpoint: with at least one Aurora Replica in the cluster, that endpoint keeps analytics traffic off the writer. AWS documents two exceptions. A cluster with no replicas routes the reader endpoint to the primary, and a failover can send it to the new primary for a short time. The reader-endpoint password is sealed in an AES-256-GCM envelope, each result stops at 1,000 rows, and the grants on that RDS role decide what comes back. When a reviewer saves a query, the SQL skills generator compiles it for Claude Code or Codex. That compiled library is what an AI SQL workforce runs on once the chat thread closes.

Go deeper: the code-validated pipeline, question to chart · how the typed SQL contract blocks out-of-schema columns · the credential vault and read-only model · the SQL query generator.

Chion vs. building it on Bedrock + LangChain

	Chion	Bedrock + LangChain DIY
What you operate	A read-only role and six connection fields	A model endpoint, a prompt chain, and the compute under it
Executed SQL	Shown beneath every chart	Visible if you log it
Read-only + RLS	Read-only by code, RLS by your role	DIY
Portable export	CHION.md, exported and version-controlled	Lives in the chain you maintain

Where the build wins: it runs inside your own AWS account, and you pick the model and the prompt chain. Chion does not hand you those choices.

A query your team saves compiles into a portable SQL skill you keep.

Example question & SQL

See what Chion generates from a plain-English question.

You ask

"Show me monthly revenue for the last 6 months"

Chion generates

SELECT
  date_trunc('month', created_at) AS month,
  SUM(amount) AS revenue
FROM orders
WHERE created_at >= now() - interval '6 months'
GROUP BY 1
ORDER BY 1;

Create a read-only Postgres role

Run this once before you connect. Chion enforces read-only at the SQL validator, but a least-privilege role is the canonical pattern.

CREATE ROLE chion_read LOGIN PASSWORD '<strong-password>';
GRANT CONNECT ON DATABASE <dbname> TO chion_read;
GRANT USAGE ON SCHEMA public TO chion_read;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO chion_read;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO chion_read;

Replace <dbname> with your database name. The ALTER DEFAULT PRIVILEGES line ensures new tables are auto-readable.

Connection string format

Reference for parsing. Chion accepts the six fields directly, no string concatenation needed.

postgresql://chion_read:<password>@<instance>.<id>.<region>.rds.amazonaws.com:5432/<dbname>?sslmode=require

Read-only by code. Code-validated by Chion's 13-step SQL pipeline.

Finding your Amazon RDS for PostgreSQL credentials

AWS Console → RDS → Databases → [your instance] → Connectivity & security

Field	Where to Find	Default
Server (Endpoint)	Connectivity & security tab → Endpoint	<instance>.<id>.<region>.rds.amazonaws.com
Port	Same tab, next to Endpoint	5432
Database	Configuration tab → DB name	postgres (or what you set at creation)
Schema	Not in console; default is public	public
User	Configuration tab → Master username	postgres (or what you set)
Password	Set at instance creation. Modify → change Master password to reset	(not retrievable)

Quick steps

1.Log in at console.aws.amazon.com/rds
2.Click Databases in the left sidebar
3.Click your PostgreSQL instance name
4.Connectivity & security tab → copy the Endpoint and Port
5.Configuration tab → note the DB name and Master username
6.Password is what you entered during creation (use Modify to reset if needed)

Open Amazon RDS for PostgreSQL console

Amazon RDS for PostgreSQL troubleshooting

Common issues and how to fix them.

Connection timeout: security group not open

Edit the security group associated with your RDS instance. Add an inbound rule allowing TCP on port 5432 from the Chion IP range. For initial testing, scope the rule to your laptop's egress IP, then narrow to the Chion IP range before going live. Avoid opening the instance to the internet. RDS instances in private subnets require a NAT gateway or VPN peering.

Master password forgotten

In the RDS console, select your instance → Modify → set a new Master password. The change applies immediately or during the next maintenance window depending on your selection.

Aurora vs RDS PostgreSQL compatibility

Aurora PostgreSQL-Compatible uses the same wire protocol. Point Chion at the Aurora reader endpoint for read-only workloads. The cluster endpoint works too but directs queries to the writer.

Aurora Serverless v2 resume delay

A cluster that has scaled its capacity down has to scale back up before it answers, so the first query after an idle period waits on Aurora rather than on Chion. Raise the minimum ACU on the cluster if the first query needs to start without that wait. The Aurora documentation linked below carries the current scaling behavior.

VPC peering and private subnets

For RDS in a private subnet, expose the endpoint via VPC peering or AWS PrivateLink to a Chion-accessible network. Public-subnet instances with a security group allow-list are simpler for trial setups.

Official Amazon RDS for PostgreSQL documentation

Authoritative references from the provider. Opens in a new tab.

Connecting to a DB instance running PostgreSQL
Official AWS guide for endpoint discovery and client connections.
Aurora PostgreSQL-Compatible Edition
Aurora-specific behaviors, reader endpoints, and Serverless v2.
Amazon RDS Multi-AZ deployments
How failover and DNS updates work for high-availability instances.
Aurora reader endpoints
Which instance a reader endpoint connects to, including a cluster with no Aurora Replicas and the failover window, checked 2026-09-01.
Amazon Bedrock user guide
The managed-model path an AWS team would build on, checked 2026-09-01.
PostgreSQL CREATE ROLE
Reference for the read-only role used by Chion.

Your credentials are encrypted

Your RDS role password is sealed in an AES-256-GCM envelope. Plaintext is decrypted into memory for a single request, held for at most 60 seconds or five reads, then purged. Chion connects with read-only permissions, and every generated statement is rejected in code unless it is a single read-only SELECT. The grants and row-level security you attached to that RDS role decide which tables and rows come back.

Read the full security model

Frequently asked questions

Common questions about using Chion with Amazon RDS for PostgreSQL.

Does Chion support Amazon Aurora PostgreSQL?

Yes. Aurora PostgreSQL-Compatible uses the same wire protocol as standard RDS PostgreSQL. Point Chion at the reader endpoint for optimal read-only performance.

Can I use IAM authentication with Chion?

Not currently. Chion uses standard PostgreSQL password authentication. Create a dedicated read-only role with a strong password.

Does Chion work with RDS Multi-AZ deployments?

Yes. Chion connects to whichever endpoint you enter. Where the deployment exposes a reader endpoint, use it with a read-only role. AWS handles failover, not Chion. The linked AWS Multi-AZ documentation covers the endpoint behavior.

Does Chion work with Aurora Serverless v2?

Yes. Aurora Serverless v2 is wire-compatible with standard PostgreSQL. If the cluster has scaled its capacity down, the first query waits while Aurora scales it back up. Raise the minimum ACU when that wait matters.

How do I connect Chion to RDS in a private VPC?

Either move the instance to a public subnet with a security group allow-list, or set up VPC peering / PrivateLink to a network Chion can reach. Direct private-subnet access is not currently supported.

Which PostgreSQL versions does RDS support for Chion?

Chion supports the current RDS-supported PostgreSQL versions. PostgreSQL 14+ is recommended for full window-function and CTE coverage.

Ready to connect your Amazon RDS for PostgreSQL database?

Open Chion, enter your credentials, and start asking questions in plain English.

Start your 7-day trial

Amazon RDS Postgres text-to-SQL that shows the SELECT under each chart