Your private cloud data stores, from one terminal

den is a terminal dashboard that opens the tunnel, keeps your IAM credentials fresh and reconnects when the connection drops, for RDS, Aurora, ElastiCache, MemoryDB, DocumentDB, Redshift, OpenSearch and Neptune. Run your team’s runbooks against the live tunnels, with the AWS profile, region and ports already set.

curl -fsSL https://github.com/lukaszgard/den/releases/latest/download/install.sh | sh

Install den Get started Install what den needs

Every data store, one tunnel

RDS and Aurora, ElastiCache, MemoryDB, DocumentDB, Redshift, OpenSearch and Neptune: den opens the forward, mints the IAM credential, refreshes it and reconnects when it drops.

Transports

Reach the network through SSM (the default), an SSH bastion, an EC2 Instance Connect Endpoint or kubectl port-forward.

AWS SSO

One login entry per SSO session, named and curated from den.yaml.

VPN and tunnels

openfortivpn with SAML, and SSH/SOCKS tunnels with a real data-path health check.

Terminal tabs

Run psql, mysql, redis-cli or mongosh inside den, next to the logs and already logged in.

Secrets

Search and copy secrets from SOPS, AWS Secrets Manager, KeePassXC and Vault; masked until revealed, never written to disk.

Runbooks

Your scripts, one folder each, run with den’s context: AWS profile, region and the live tunnel ports. Share them from git.

AI agents

den mcp lets Claude Code or Cursor list services and open tunnels without ever seeing a credential.

den doctor

Checks the tools your den.yaml needs and prints the install commands for your OS.