feat: AWS RDS/Aurora IAM authentication for the PostgreSQL sink - #1591
Open
dcoric wants to merge 38 commits into
Open
feat: AWS RDS/Aurora IAM authentication for the PostgreSQL sink#1591dcoric wants to merge 38 commits into
dcoric wants to merge 38 commits into
Conversation
# Conflicts: # src/config/generated/config.ts
Adds an `awsIamAuth` object ({ enabled, region }) to the PostgreSQL sink
schema and regenerates the config types. This is the configuration surface
for authenticating to Amazon RDS/Aurora with an IAM auth token instead of a
static password; the connection wiring follows in a later commit.
When `awsIamAuth.enabled` is set, the pool is built from the discrete host/port/user fields and the static password is replaced by a provider function. node-postgres calls it for every new connection, so each one gets a fresh (~15 min) IAM token and refresh is automatic; no password is stored. The token is generated with the AWS SDK default credential chain via `@aws-sdk/rds-signer`, which is loaded lazily and declared as an optional dependency so non-AWS installs stay lean and still type-check. TLS is required by RDS for IAM auth, so `ssl` defaults to true when unset, and a connection string is ignored in this mode.
Adds unit coverage for the IAM auth path: a generated token is used as the password, TLS defaults on, an explicit ssl setting is preserved, a connection string is ignored, the region falls back to AWS_REGION, a missing host/user raises a clear error, and a token-generation failure propagates. The optional @aws-sdk/rds-signer module is stubbed so no real AWS credentials are needed.
Adds an AWS RDS/Aurora IAM authentication section to the PostgreSQL backend docs (config example, region/TLS behavior, the rds_iam grant, and the optional @aws-sdk/rds-signer dependency) and drops the stale "no IAM auth helper" limitation note.
Closes the coverage gaps the review surfaced on the IAM auth path: - the loadRdsSigner catch branch (the actionable "install the optional @aws-sdk/rds-signer dependency" error a user hits after `npm install --omit=optional`), exercised by re-importing the helper against a registry where the dynamic import rejects; - the AWS_DEFAULT_REGION fallback and the AWS_REGION-over-AWS_DEFAULT_REGION priority; - the default IAM token port (5432) reaching the signer when none is set.
✅ Deploy Preview for endearing-brigadeiros-63f9d0 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## feat/postgres #1591 +/- ##
=================================================
+ Coverage 90.41% 90.49% +0.08%
=================================================
Files 87 92 +5
Lines 8661 9218 +557
Branches 1603 1729 +126
=================================================
+ Hits 7831 8342 +511
- Misses 799 844 +45
- Partials 31 32 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| const config: PoolConfig = {}; | ||
| const iamAuthEnabled = Boolean(db.awsIamAuth?.enabled); | ||
|
|
||
| if (iamAuthEnabled) { |
Contributor
There was a problem hiding this comment.
Same silent-precedence point as in #1584: when awsIamAuth.enabled is set, connectionString is dropped without any signal. A console.warn noting it's being ignored in IAM mode would make it observable
# Conflicts: # website/docs/architecture/architecture.md
…-iam-auth # Conflicts: # website/docs/architecture/architecture.md
…-iam-auth # Conflicts: # package-lock.json
dcoric
marked this pull request as ready for review
August 24, 2026 10:21
…-connection-config # Conflicts: # website/docs/architecture/architecture.md
…-iam-auth # Conflicts: # test/db/postgres/helper.test.ts # website/docs/architecture/architecture.md
jescalada
force-pushed
the
feat/postgres-rds-iam-auth
branch
2 times, most recently
from
August 26, 2026 05:43
06e8ef8 to
856c8ab
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds AWS RDS/Aurora IAM token authentication to the PostgreSQL sink, the follow-up to #1497 / #1532 (the mongo backend already supports AWS auth via
AWS_CREDENTIAL_PROVIDER; the postgres sink previously only accepted a static password).awsIamAuthoption ({ enabled, region }) on the postgres sink. When enabled, the pool is built from the discretehost/port/userfields and the static password is replaced by a token provider function.pginvokes it for every new connection, so each one receives a fresh (~15 min) IAM token and refresh is automatic - no password is stored.@aws-sdk/rds-signer, loaded lazily and declared as an optional dependency so non-AWS installs stay lean and still type-check. Enabling IAM auth without the dependency installed throws a clear, actionable error.ssldefaults totruewhen unset; aconnectionStringis ignored in this mode.regionresolves fromawsIamAuth.region, thenAWS_REGION/AWS_DEFAULT_REGION, then the SDK's default region resolution.AWS_REGION/AWS_DEFAULT_REGIONand their priority), the default port, the missing-dependency error, and token-generation failure propagation. There is no integration test - the IAM path needs a real RDS/Aurora instance and credentials.{ "type": "postgres", "host": "mydb.abc123.eu-west-2.rds.amazonaws.com", "port": 5432, "user": "gitproxy_iam", "database": "gitproxy", "awsIamAuth": { "enabled": true, "region": "eu-west-2" }, "enabled": true }Known follow-ups (non-blocking)
tscis not fully independent of the optional dependency: after a slim install (npm install --omit=optional) the dynamic-import specifier resolves to aTS2307. CI usesnpm ci, which installs optional dependencies, so type checks and builds pass; runtime is unaffected. A follow-up could suppress the import-line diagnostic.logConfigurationlogs the full sink config, which in the non-IAM (static password) path serializes credentials. IAM mode is safe (the token lives only in the pool's password function and is never written back into the config), but redacting credentials in that log line is a worthwhile separate fix.Related Issue
Resolves #1561
Checklist
General
Documentation
Configuration
config.schema.json) was modified: regeneratedsrc/config/generated/config.tsTests
npm test)npm run lintandnpm run format:check)npm run check-types)