RDS Proxy Pinning Verdict

Finds out WHY YOUR CONNECTION POOLER STOPPED POOLING. Pure decision function over session facts you already have: no I/O, no database connection, no dependency on the proxy.

THE SYMPTOM. You put a connection proxy -- AWS RDS Proxy, or PgBouncer -- in front of the database specifically so it would survive serverless scale-out. Weeks later the database is back at its connection limit. The proxy's own health check is GREEN. Nothing in the app logs mentions connections, pools or errors. CPU and memory look normal. The only real signal is a graph that should not exist: connections climbing in lockstep with traffic, exactly as if the proxy were not there.

IT IS NOT AN OUTAGE AND IT IS NOT A LEAK. It is PINNING, and it is correct, documented, silent behaviour.

THE MECHANISM. A pooling proxy multiplexes many client connections onto a few real ones -- until a client session does something that cannot safely be shared: changes session state with a SET, creates something that exists on only one backend connection (a temp table, a prepared statement, a cursor), or takes a session-scoped lock. At that point the proxy PINS that client to its own dedicated backend connection for the rest of the session. Multiplexing simply stops for it. Nothing errors, because pinning is the CORRECT thing for the proxy to do -- the alternative would be handing another client a connection carrying your session state.

So the failure has no error to search for. The proxy is behaving exactly as documented, the app is behaving exactly as written, and the capacity you bought the proxy for is gone.

IT NAMES THE CAUSE, not just the outcome, so the fix is a specific line of code rather than a configuration guess. Every verdict cites the vendor documentation it rests on.

VERIFIED: 281 tests, measured by running the suite.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function evaluateSession(input: SessionInput): SessionVerdict;
  export function isProxyTarget(value: unknown): value is ProxyTarget;
  export function evaluateMysqlFacts(facts: MySqlSessionFacts):;
  export function evaluatePostgresFacts( mode: PgMode, facts: PostgresSessionFacts, pgbouncer?: PgBouncerOptions, ):;
  export function evaluateSqlServerFacts(facts: SqlServerSessionFacts):;
  export function classifyStatementSize(bytes: number | undefined): TriggerResult;

  export type CitationKey = keyof typeof CITATIONS;
  export type SessionInput = | { target: "rds-proxy-mysql";
  export type PgMode = "rds-proxy" | "pgbouncer-transaction" | "pgbouncer-statement";
  export type Rule<F> = (facts: F, ctx?: unknown) => TriggerResult | null;