Advanced AI Prompt for AWS RDS Database Authentication IAM Policy

Act as a Database Security Architect. Create an IAM policy that enables passwordless AWS RDS IAM Database Authentication for the IAM principal [DB_USER]. The policy must authorize the `rds-db:connect` action. The target resource ARN must be strictly and precisely formatted as `arn:aws:rds-db:[REGION]:[ACCOUNT_ID]:dbuser:[DB_RESOURCE_ID]/[DB_USER]`. Explicitly instruct the avoidance of wildcards (`*`) in the resource string to prevent cross-database access. Add a brief technical explanation detailing how this IAM policy works in tandem with the internal database engine's `GRANT rds_iam` permissions.