as we're running multiple AWS clusters we could make the operator clever enough to discover MariaDBProvider from the AWS RDS API. The problem is the root password, but we can use IAM authentication for this:
https://aws.amazon.com/premiumsupport/knowledge-center/users-connect-rds-iam/
Tags on the RDS clusters could tell us which cluster should be used for which type of database (production, development, VIP, etc.)