roll RDS instance CAs and bounce immediately

rollRdsCa.sh

#!/bin/bash

set -e -u -o pipefail

aws --output text ec2 describe-regions | while read REG ENDPOINT OPT REGION; do
  aws --region $REGION rds describe-db-instances | \
    jq -r '[.DBInstances[]|select(.CACertificateIdentifier == "rds-ca-2015")|{id:.DBInstanceIdentifier, az:.AvailabilityZone,engine:.Engine, user:.MasterUsername, end:.Endpoint.Address}]'
done

read -p "Roll cert and bounce these instances? <ENTER> to proceed, Ctrl-c to cancel: "

aws --output text ec2 describe-regions | while read REG ENDPOINT OPT REGION; do
  aws --region $REGION rds describe-db-instances | jq -r '.DBInstances[]|select(.CACertificateIdentifier == "rds-ca-2015")|.DBInstanceIdentifier'|while read;do
    aws --region $REGION rds modify-db-instance \
      --db-instance-identifier $REPLY \
      --ca-certificate-identifier rds-ca-2019 \
      --apply-immediately | jq -r .DBInstance.DBInstanceIdentifier | while read DB; do echo "$REGION,${DB}";done
  done
done