Is there a specific string format the connection has when connecting via AWS IAM? I think it'd be preferred to check for that over adding a new server option.

Just a missing password field, maybe an AWS domain in the URL, but I don't think there's anything that's enough to make an inference.

One thing that might be possible is if we detected the URL scheme and had people setawsiamrds://... instead ofpostgres://, or add a query param? It is unforunate we need a new flag just for aws auth, but it's probable we would exapand this in the future. My only worry is that just detecting it in the connection string would be non-obvious, since I haven't really seen it anywhere else, but to be fair I haven't really done much research.

Yeah I wouldn't wanna change the protocol because that kinda implies it's not speakingpostgres protocol. I think given we may have other auth schemes in the future we need to support, a flag seems fine to me and better than any parsing options I can think of.