I am building a serverless application using Lambda and RDS with Java and Postgres. One of my lambdas will need high concurrency and only execute a few small queries per request. To facilitate concurrency I want to use RDS proxy, and as I read the user guide I stumbled on this little beauty:
"Prepared statements cause the proxy to pin the session. This rule applies whether the prepared statement uses SQL text or the binary protocol."
It also lists "Using prepared statements, setting parameters, or resetting a parameter to its default" under "Conditions that cause pinning for RDS for PostgreSQL."
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-managing.html#rds-proxy-pinning
Pinning the session is undesirable because it prevents other concurrent lambda invocations from reusing the connection. Right now all of my queries use prepared statements. Maybe a pinned session wouldn't be so bad for a warm lambda, but as I scale up I might want to reduce pinning as much as possible.
The natural solution is to stop using prepared statements, but doing so could make my application vulnerable to SQL injection. My question is this: is there an alternative to prepared statements that prevents injection that would also avoid pinning? Something compatible with JDBC?
Given that prepared statements are so ubiquitous and useful for security, it makes me wonder what the AWS engineers had in mind as an alternative. Are there common practices to prevent pinning when using RDS proxy?