# DefaultAuthScheme

The default authentication scheme that the proxy uses for client connections to the proxy and connections from the proxy to the underlying database.

- Source: [`aws-rds/lib/proxy.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-rds/lib/proxy.ts#L49)
- Type last changed: v2.235.0 · 15 Jan 2026

## Example

```ts
declare const vpc: ec2.Vpc;
const instance = new rds.DatabaseInstance(this, 'Database', {
  engine: rds.DatabaseInstanceEngine.postgres({
    version: rds.PostgresEngineVersion.VER_17_7,
  }),
  vpc,
  iamAuthentication: true,
});

const proxy = new rds.DatabaseProxy(this, 'Proxy', {
  proxyTarget: rds.ProxyTarget.fromInstance(instance),
  vpc,
  defaultAuthScheme: rds.DefaultAuthScheme.IAM_AUTH, // No secrets required
});

// Grant IAM permissions for database connection
const role = new iam.Role(this, 'DBRole', { assumedBy: new iam.AccountPrincipal(this.account) });
proxy.grantConnect(role, 'database-user'); // Database user must be specified when using IAM auth
```

## Members

| Member | Description |
| --- | --- |
| `IAM_AUTH` | IAM authentication. |
| `NONE` | No default authentication. |

## Referenced by

- [`DatabaseProxyOptions`](/v2/docs/aws-cdk-lib.aws_rds.DatabaseProxyOptions).defaultAuthScheme