search

kamu-data / kamu-node

Back-end implementation of the Open Data Fabric protocol
https://kamu.dev
Other
13 stars 2 forks source link

Use IAM tokens for the database access from `kamu_api_server` #137

Open zaychenko-sergei opened 2 months ago

zaychenko-sergei commented 2 months ago

Currently we are using AWS secrets to get credentials to access the RDS database. The recommended security practice is to use temporary IAM tokens, which last only for 15 minutes.

See the following learningmaterial: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.AWSCLI.PostgreSQL.html

Note, on today there is no direct API in Rust AWS SDK to generate IAM tokens. In theory it should be possible to generate it via lower-level AWS SDK functions:

https://github.com/awslabs/aws-sdk-rust/issues/951

Note, current implementation is not functional and should be replaced.

One of the alternative ideas is to use AWS CLI, but that would assume adding it to API server Docker image:

export PGPASSWORD="$(aws rds generate-db-auth-token --hostname=europort-kamu-api-server.ch4m4so24wx0.us-west-2.rds.amazonaws.com --port 5432 --username kamu_api_server --region=us-west-2)"`