Skip to main content

​
Overview

fjall tunnel opens a secure AWS Session Manager (SSM) port-forwarding tunnel to your application’s database through a bastion host. Connect local database tools (pgAdmin, DBeaver, psql) to your private RDS instance without exposing it to the public internet.

​
Prerequisites

  • AWS Session Manager plugin (session-manager-plugin) installed
  • Valid AWS credentials with SSM permissions
  • A deployed application with a bastion host and database

​
Usage

fjall tunnel [app-name] [options]
The application name is optional. When omitted, Fjall auto-detects it from the current directory or prompts you to pick one.

​
Arguments

ArgumentDescriptionRequired
app-nameApplication nameNo (auto-detected, or prompted if omitted)

​
Options

OptionDescriptionExample
-d, --database <name>Select a specific database (required when multiple exist)-d analytics
-l, --local-port <port>Local port for the tunnel (defaults to the database port)-l 5433
-v, --verboseShow detailed output-v
--non-interactiveForce plain CLI output (no UI)--non-interactive

​
Basic usage

Open a tunnel to your application’s database: 
fjall tunnel api
If the application has multiple databases, select one with -d: 
fjall tunnel api --database analytics
Use a custom local port: 
fjall tunnel api --local-port 5433

​
How it works

  1. Prerequisites: checks that the AWS Session Manager plugin is installed.
  2. Bastion discovery: finds the bastion host instance in your application’s VPC.
  3. Database discovery: discovers available RDS endpoints.
  4. Tunnel: opens an SSM port-forwarding session through the bastion to the database.
When a single database is found, Fjall connects to it automatically. When more than one is found, a picker appears: 
Select a database to connect to:
Each option is labelled with the database name and shows its engine and type (for example postgres (Instance)). The tunnel stays open until you press Ctrl+C.

​
Connecting

Once the tunnel is open, connect with your preferred database tool. The connection string is displayed when the tunnel opens. 
psql -h localhost -p 5432 -U myuser -d mydb

​
Next Steps

fjall deploy

Deploy applications and infrastructure to AWS.

fjall list

List resources inside an application’s infrastructure.

fjall restore

Restore resources from AWS Backup recovery points.

fjall secrets

Manage application secrets backed by AWS Secrets Manager.