Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use IAM tokens for the database access from kamu_api_server #137

Open
zaychenko-sergei opened this issue Sep 25, 2024 · 0 comments
Open
Labels
enhancement New feature or request

Comments

@zaychenko-sergei
Copy link
Contributor

Currently we are using AWS secrets to get credentials to access the RDS database.
The recommended security practice is to use temporary IAM tokens, which last only for 15 minutes.

See the following learningmaterial:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.AWSCLI.PostgreSQL.html

Note, on today there is no direct API in Rust AWS SDK to generate IAM tokens.
In theory it should be possible to generate it via lower-level AWS SDK functions:

awslabs/aws-sdk-rust#951

Note, current implementation is not functional and should be replaced.

One of the alternative ideas is to use AWS CLI, but that would assume adding it to API server Docker image:

export PGPASSWORD="$(aws rds generate-db-auth-token --hostname=europort-kamu-api-server.ch4m4so24wx0.us-west-2.rds.amazonaws.com --port 5432 --username kamu_api_server --region=us-west-2)"`
@zaychenko-sergei zaychenko-sergei added the enhancement New feature or request label Sep 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant