RDS IAM database auth for the primary ledger store (not just the mirror source)?

[miekassu]

We run Formance Ledger (CC) on AWS ECS Fargate against Aurora PostgreSQL. The ledger currently connects with a static password via POSTGRES_URI, sourced from AWS Secrets Manager.

We saw #1434 add SigV4 token minting - but scoped to the mirror source connection and driven through the Kubernetes operator CRD (--mirror-aws-iam-region).

Questions on your plans:

1. Any intent to extend RDS IAM auth to the primary datastore used by serve/worker (e.g. a --postgres-aws-iam-region-style option), so the main store can connect without a static password?
2. Rough target release (v3.x) and timeline?
3. Would it be exposed on the binary/CLI directly, usable outside the operator? We deploy the raw image on ECS, not via the operator.
4. Any recommended interim pattern for password-less main-store DB auth today, short of running the operator?