ah, looks like python:

database = aws.rds.Instance(
            f"my-db",
    # other options here
        )

db_provider = postgresql.Provider(
    "rds-db",
    host=database.address,
    port=database.port,
    username=database.username,
    password=database.password,
)

then once you’ve done that, pass the provider to the role, eg;

postgres_db = postgresql.Database(
    "thedb",
    name="an internal db"
    owner=database.username,
    opts=pulumi.ResourceOptions(provider=db_provider, parent=db_provider),
)

While I am doing this, I notice a quirk in my code. I create a random password for the db master user with

aws.secretsmanager.get_random_password()

and the feed this value to

aws.rds.Instance(password=random_password.random_password)

The undesired side effect is that the password is re-generated every time i run

pulumi up

needlessly increasing my wait time. Is there a way to say "only generate a random password if the instance is being created but leave it unchanged otherwise"?