It may sound like an easy task to do, but it took me a while to figure out the proper format of doing this, I came across a few walkthroughs on doing this with MySQL, but none with PostgreSQL. While the process is technically the same when trying to connect to an RDS instance running MySQL instead of PostgreSQL, it’s still worth outlining the major steps here just for the sake of clarity, hoping that this would save someone’s time :)

The goal is to connect to an RDS instance from your local machine via a Bastion Server(aka jumpstation) — this is a pretty common setup nowadays.

Solution:

First of all, make sure you have necessary credentials to connect to the bastion server(username, password or public key file) it’s worth checking with dev ops/ system admins if you need to have your IP whitelisted to access the subnet.

We’ll be using PgAdmin 4 to interact with the DB after we establish the SSH tunnel

• if you are not using a key to connect:

ssh 
   -L 5432:your.rds.endpoint.rds.amazonaws.com:5432 
   sshuser@yourserver.com

 -L   
set up the forwarding

5432
that first number is the port on your local machine

your.rds.endpoint.amazonaws.com
The name of the rds endpoing

5432
the port on the remote computer

sshuser@yourserver.com
how you log in to your ec2 instance

• If you are using a key

ssh 
   -i /path/to/sshkey
   -L 5432:your.rds.endpoint.rds.amazonaws.com:5432 
   sshuser@yourserver.com
      
-i
Specifies an alternate identification file to use for public key 
authentication. The file location is assumed to be in the current 
working directory unless you specify a fully-qualified or relative path. 

The default identity file is ~/.ssh2/identification. 
You can also specify an identity file in the configuration
file using the IdentificationFile keyword.

2. Configuring pgAdmin 4

Hostname: localhost

might sound odd, but since you’ve forwarded the port from the RDS to your machine, localhost is where you’ll point pgAdmin to.

Port: 5432 (or any other port you specified when forwarding. 5432 is the default in most cases)

Username & Password: the RDS credentials

Hit save, wait for the crappy interface with no indicator to establish a connection, fingers crossed …. and you should be done!