diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
-# Revision history for amazonka-contrib-rds-utils
+# Changelog for amazonka-contrib-rds-utils
 
-## 0.1.0.0 -- YYYY-mm-dd
+## 1.6.1.1 -- 2021-12-12
 
-* First version. Released on an unsuspecting world.
+* New `--discover` flag to auto-discover AWS credentials.
+
+## 1.6.1.0 -- 2021-08-13
+
+* Initial release.
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -14,3 +14,6 @@
 ```
 make build
 ```
+
+The repository contains [AWS root and intermediate certificates](./aws-root-intermediate-certs.pem) obtained from [AWS docs](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html).
+You can use them to test secure connections with the tokens generated by this library.
diff --git a/amazonka-contrib-rds-utils.cabal b/amazonka-contrib-rds-utils.cabal
--- a/amazonka-contrib-rds-utils.cabal
+++ b/amazonka-contrib-rds-utils.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               amazonka-contrib-rds-utils
-version:            1.6.1.0
+version:            1.6.1.1
 
 -- A short (one-line) description of the package.
 -- synopsis:
@@ -39,7 +39,7 @@
                     ,   bytestring    >= 0.9
                     ,   lens          >= 4.4
                     ,   text          >= 1.1
-                    ,   time          >= 1.11
+                    ,   time          >= 1.9.1
 
     hs-source-dirs:     src
 
@@ -80,7 +80,7 @@
                         -static
                         -optl=-pthread
                         -threaded
-                        -rtsopts "-with-rtsopts=-N -I3 -M1.75G"
+                        -rtsopts "-with-rtsopts=-N"
                         -feager-blackholing
 
   cc-options:           -static
diff --git a/exe/Main.hs b/exe/Main.hs
--- a/exe/Main.hs
+++ b/exe/Main.hs
@@ -21,67 +21,78 @@
 awsRegionEnvName :: Text
 awsRegionEnvName = "AWS_REGION"
 
+
 -- | Works similarly to / aws rds generate-db-auth-token --hostname --port --username --region /
 main :: IO ()
 main = run =<< execParser opts
     where
         opts =
-            info (awsCreds <**> helper)
+            info (awsOpts <**> helper)
                  ( fullDesc
                 <> progDesc "Generate a temporary access token for RDS"
                 <> header "generate-db-auth-token is a Haskell equivalent of 'aws rds generate-db-auth-token' CLI utility"
                  )
 
-run :: AWSCreds -> IO () 
-run creds = do
-    lgr     <- newLogger Info stdout
-    env     <- AWSEnv.newEnv $ AWSAuth.FromEnv
+
+run :: AWSOptions -> IO () 
+run parsedOpts = do
+    let credsMethod =   if      (useDiscover parsedOpts)
+                        then    AWSAuth.Discover
+                        else    AWSAuth.FromEnv
                                     AWSAuth.envAccessKey
                                     AWSAuth.envSecretKey
                                     (Just AWSAuth.envSessionToken)
                                     (Just awsRegionEnvName)
 
-    case (RDSU.regionFromText . pack . region $ creds) of
+    lgr     <- newLogger Info stdout
+    env     <- AWSEnv.newEnv credsMethod
+
+    case (RDSU.regionFromText . pack . region $ parsedOpts) of
         Left err  -> die $ "Error: " <> err
         Right reg -> do
             token <- RDSU.generateDbAuthToken
-                        ((env & AWSEnv.envLogger .~ lgr) & AWSEnv.envRegion .~ reg)
-                        (hostname   creds)
-                        (port       creds)
-                        (username   creds)
+                        (env & AWSEnv.envLogger .~ lgr)
+                        (hostname   parsedOpts)
+                        (port       parsedOpts)
+                        (username   parsedOpts)
                         reg
             hPut stdout token
 
 
-
-data AWSCreds = AWSCreds
-    { hostname  :: RDSU.Endpoint
-    , port      :: RDSU.Port
-    , username  :: RDSU.DBUsername
-    , region    :: String
+data AWSOptions = AWSOptions
+    { hostname      :: RDSU.Endpoint
+    , port          :: RDSU.Port
+    , username      :: RDSU.DBUsername
+    , region        :: String
+    , useDiscover   :: Bool
     }
 
-awsCreds :: Parser AWSCreds
-awsCreds = AWSCreds
+
+awsOpts :: Parser AWSOptions
+awsOpts = AWSOptions
         <$> strOption
-            ( long "hostname"
-            <> metavar "RDS_ENDPOINT"
-            <> help "RDS Endpoint could be found on AWS RDS web console"
+            (   long "hostname"
+            <>  metavar "RDS_ENDPOINT"
+            <>  help "RDS Endpoint could be found on AWS RDS web console"
             )
         <*> option auto
-            ( long "port"
-            <> help "RDS Database Port"
-            <> showDefault
-            <> value 5432
-            <> metavar "RDS_PORT"
+            (   long "port"
+            <>  help "RDS Database Port"
+            <>  showDefault
+            <>  value 5432
+            <>  metavar "RDS_PORT"
             )
         <*> strOption
-            ( long "username"
-            <> help "RDS Username"
-            <> metavar "RDS_USERNAME"
+            (   long "username"
+            <>  help "RDS Username"
+            <>  metavar "RDS_USERNAME"
             )
         <*> strOption
-            ( long "region"
-            <> help "AWS Region"
-            <> metavar "AWS_REGION"
+            (   long "region"
+            <>  help "AWS Region"
+            <>  metavar "AWS_REGION"
+            )
+        <*> switch
+            (   long "discover"
+            <>  help "auto-discover AWS credentials. Without this flag AWS env vars will be required"
             )
diff --git a/src/Network/AWS/RDS/Utils.hs b/src/Network/AWS/RDS/Utils.hs
--- a/src/Network/AWS/RDS/Utils.hs
+++ b/src/Network/AWS/RDS/Utils.hs
@@ -12,14 +12,13 @@
 where
 
 import           Prelude                    hiding ( drop, length )
-import           Control.Lens               ( (^.) )
+import           Control.Lens               ( (^.), (&), (.~) )
 import           Control.Monad.Trans.AWS    ( runResourceT, runAWST )
 import           Data.ByteString            ( ByteString, drop, length )
 import           Data.ByteString.Char8      ( pack )
 import qualified Data.Text                  as T
 import qualified Data.Time.Clock            as Clock
 import           Network.AWS                ( _svcPrefix
-                                            , within
                                             )
 import qualified Network.AWS.RDS            as RDS
 import           Network.AWS.Endpoint       ( setEndpoint )
@@ -76,18 +75,18 @@
                                     , port       = prt
                                     , dbUsername = username
                                     }
+        regionalEnv = env & Env.envRegion .~ region
 
     signingTime <- Clock.getCurrentTime
 
-    runResourceT . runAWST env $
-        within region $ do
-            val <- Presign.presignURL
-                    (env ^. Env.envAuth)
-                    (env ^. Env.envRegion)
-                    signingTime
-                    tokenExpiration
-                    action
-            pure $ dropPrefix val
+    runResourceT . runAWST regionalEnv $ do
+        val <- Presign.presignURL
+                (regionalEnv ^. Env.envAuth)
+                (regionalEnv ^. Env.envRegion)
+                signingTime
+                tokenExpiration
+                action
+        pure $ dropPrefix val
 
 
 data PresignParams = PresignParams