Browse a private RDS from a laptop via SSM port forwarding

An RDS instance with no public address can be opened in a desktop SQL client without a bastion SSH key or open ports: run aws ssm start-session with document AWS-StartPortForwardingSessionToRemoteHost through any SSM-managed EC2 instance in the VPC whose security group the DB allows, mapping the RDS endpoint port 5432 to a local port, then point DBeaver at localhost. The session-manager-plugin installs without sudo from AWS's bundle zip (install -i ~/.local/... -b ~/.local/bin/...). Pair it with a SELECT-only role that has default_transaction_read_only=on so browsing can never write.