The article doesn't mention whether the token is limited to the account with the RDS database or can access additional resources.

I'd imagine it's only scoped to a single customer account but I'm curious what it gives access to.