db connect

Reach a private utopia database through an SSM port-forward on a utopia server. Password stays in the secret — never printed by this command.

awsutopia db connect <name> --via <server> [--force] [--dry-run] [--json]

awsutopia db connect app --via web --dry-run
awsutopia db connect app --via web

What happens

1. Resolves the utopia-tagged RDS instance
2. Loads the connection secret (db-<name>) — output is always redacted
3. Starts aws ssm start-session port-forward via --via server → RDS:5432
4. You run psql against 127.0.0.1 (pull password from the secret yourself if needed)

--dry-run prints the plan without loading the secret or starting a tunnel.

Clear errors

Code	Meaning
DB_CONNECT_NO_PATH	Missing --via — private RDS isn’t on the public internet
DB_CONNECT_SERVER_MISSING	Tunnel server not found in this project
DB_SECRET_MISSING	Connection secret wasn’t created / was deleted
DB_NOT_FOUND / DB_PROJECT_MISMATCH	Same ownership rules as destroy