How to back up Amazon RDS for PostgreSQL to a Windows PC

RDS takes automated snapshots and keeps them for the retention period you set (up to 35 days), plus any manual snapshots you make. They're good for disaster recovery, but they're AWS-only: you can't download a snapshot and restore it into PostgreSQL somewhere else, and they go when the account or instance goes. A regular pg_dump gives you a portable copy that you control. That's useful for compliance, for leaving AWS, and for loading production data into a local database.

This guide works for RDS for PostgreSQL and Aurora PostgreSQL alike.

Step 1: Make the database reachable from your PC

Your Windows machine needs a network path to port 5432 on the instance. Two common setups:

• Publicly accessible instance. In the RDS console, the instance's Connectivity & security tab shows Publicly accessible: Yes. Edit its VPC security group, add an inbound rule for PostgreSQL (TCP 5432) from My IP (your public address, as a /32), not from 0.0.0.0/0.
• Private instance (recommended for production). Keep it private and reach it over a VPN, AWS Client VPN, or an SSH tunnel through a bastion host. With a tunnel such as ssh -N -L 5433:mydb.xxxx.us-east-1.rds.amazonaws.com:5432 ec2-user@bastion, pg_dump connects to localhost:5433.

If the connection times out, it's almost always the security group or a private subnet. If it's refused with an authentication error, the network part is working.

Step 2: SSL

On RDS for PostgreSQL 15 and later the rds.force_ssl parameter is on by default, so connections without SSL are rejected. pg_dump's default (prefer) tries SSL first, which works. To make it explicit:

$env:PGSSLMODE = 'require'

require encrypts the connection but doesn't verify the server's certificate. For verification, download the RDS certificate bundle for your region from AWS and use verify-full with PGSSLROOTCERT pointing at it.

Step 3: Back it up

Use the master user or any role that can read every table:

$env:PGSSLMODE = 'require'
& 'C:\Program Files\PostgreSQL\18\bin\pg_dump.exe' `
    -h mydb.abc123xyz.us-east-1.rds.amazonaws.com -p 5432 -U postgres `
    -F c -f "D:\Backups\mydb-$(Get-Date -Format yyyyMMdd-HHmm).dump" mydb

The client tools must be at least the instance's major version (shown under Configuration → Engine version). If the instance is newer than your pg_dump, you'll get a server version mismatch.

Step 4: Schedule it

Plug the values into the script from the main Windows guide:

$Database  = 'mydb'
$PgHost    = 'mydb.abc123xyz.us-east-1.rds.amazonaws.com'
$Port      = 5432
$User      = 'postgres'
$env:PGSSLMODE = 'require'

If you use an SSH tunnel, the tunnel has to be up when the task runs. A second scheduled task (or a small service) that keeps ssh -N -L … running is the usual answer.

What a dump doesn't include

• Roles. RDS roles (including rds_superuser grants) aren't in a single-database dump. pg_dumpall --globals-only --no-role-passwords captures them; RDS doesn't let anyone read password hashes.
• Parameter groups, instance settings, extensions' server-side config. Those are AWS configuration. Keep them in infrastructure-as-code if you'd need to rebuild.

Restoring

Restore into any PostgreSQL, local or RDS, with:

& "$bin\createdb.exe" -h localhost -U postgres mydb_copy
& "$bin\pg_restore.exe" -h localhost -U postgres -d mydb_copy --no-owner --no-privileges D:\Backups\mydb-20261014-0200.dump

See restoring a .dump file on Windows for restoring over an existing database, and copying a database to another server to refresh a staging copy from RDS.

How PostgresBackup handles RDS

In PostgresBackup, add the instance endpoint as a server (with SslMode=Require in the connection string, or paste a postgresql://…?sslmode=require URI) and create a nightly job. Its background service runs the backup from boot and keeps the retention you choose. Clone turns "refresh my local copy of production" into one click. Through a tunnel, point the server at localhost and the tunnel port.