[EKS] [request]: RDS IAM Proxy Sidecar injector to allow connecting to RDS from pods with IAM Roles instead of passwords

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
What do you want us to build?

A kubernetes sidecar similar to https://github.com/GoogleCloudPlatform/cloudsql-proxy that we can use together with the [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) feature to be able to connect to RDS databases transparently using IAM instead of RDS passwords.
Ideally the sidecar could be injected with an annotation by a mutating admission controller.

**Which service(s) is this request for?**
EKS, but such a proxy would also be useful outside kubernetes.

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I want my applications running in EKS to connect to RDS without having to use static passwords. Since you can use [AWS IAM](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html) to get a temporary db auth token it would make sense to build a database proxy that can do that for you transparently. You'd connect to the proxy on 127.0.0.1:5432 and the proxy authenticates to RDS and forwards all traffic to RDS after that.

I didn't encounter any solution yet that allows for connecting to RDS from existing applications with IAM without modifying the application source code.

**Are you currently working around this issue?**
I'm thinking about writing the proxy and the admission controller myself, but even if that's the case it would be great if AWS would own the codebase.

Start by reading the linked EKS IAM Roles for Service Accounts and RDS IAM database authentication documentation, then compare the requested behavior with the linked Cloud SQL Proxy. Define the scope of both the RDS proxy and annotation-driven mutating admission controller; done means existing applications can connect through localhost without static RDS passwords.

Written by the indexing model from the issue text.