Skip to content

Commit 034f726

Browse files
antontroshinhhunter-ms
antontroshin
and
hhunter-ms
authored
Add AWS IAM authentication fields in PostgreSQL components (#4311)
* Add AWS IAM authentication fields in PostgreSQL components Signed-off-by: Anton Troshin <[email protected]> * change wording Signed-off-by: Anton Troshin <[email protected]> --------- Signed-off-by: Anton Troshin <[email protected]> Co-authored-by: Hannah Hunter <[email protected]>
1 parent 0edadef commit 034f726

File tree

4 files changed

+61
-8
lines changed

4 files changed

+61
-8
lines changed

‎daprdocs/content/en/reference/components-reference/supported-bindings/postgresql.md

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -56,23 +56,27 @@ Authenticating with Microsoft Entra ID is supported with Azure Database for Post
5656
### Authenticate using AWS IAM
5757

5858
Authenticating with AWS IAM is supported with all versions of PostgreSQL type components.
59-
The user specified in the connection string must be an AWS IAM enabled user granted the `rds_iam` database role.
59+
The user specified in the connection string must be an already existing user in the DB, and an AWS IAM enabled user granted the `rds_iam` database role.
6060
Authentication is based on the AWS authentication configuration file, or the AccessKey/SecretKey provided.
6161
The AWS authentication token will be dynamically rotated before it's expiration time with AWS.
6262

6363
| Field | Required | Details | Example |
6464
|--------|:--------:|---------|---------|
65-
| `awsRegion` | Y | The AWS Region where the AWS Relational Database Service is deployed to. | `"us-east-1"`
66-
| `accessKey` | Y | AWS access key associated with an IAM account | `"AKIAIOSFODNN7EXAMPLE"`
67-
| `secretKey` | Y | The secret key associated with the access key. | `"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"`
65+
| `useAWSIAM` | Y | Must be set to `true` to enable the component to retrieve access tokens from AWS IAM. This authentication method only works with AWS Relational Database Service for PostgreSQL databases. | `"true"` |
66+
| `connectionString` | Y | The connection string for the PostgreSQL database.<br>This must contain an already existing user, which corresponds to the name of the user created inside PostgreSQL that maps to the AWS IAM policy. This connection string should not contain any password. Note that the database name field is denoted by dbname with AWS. | `"host=mydb.postgres.database.aws.com user=myapplication port=5432 dbname=my_db sslmode=require"`|
67+
| `awsRegion` | Y | The AWS Region where the AWS Relational Database Service is deployed to. | `"us-east-1"` |
68+
| `awsAccessKey` | Y | AWS access key associated with an IAM account | `"AKIAIOSFODNN7EXAMPLE"` |
69+
| `awsSecretKey` | Y | The secret key associated with the access key | `"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"` |
70+
| `awsSessionToken` | N | AWS session token to use. A session token is only required if you are using temporary security credentials. | `"TOKEN"` |
6871

6972
### Other metadata options
7073

71-
| Field | Required | Binding support |Details | Example |
74+
| Field | Required | Binding support | Details | Example |
7275
|--------------------|:--------:|-----|---|---------|
73-
| `maxConns` | N | Output | Maximum number of connections pooled by this component. Set to 0 or lower to use the default value, which is the greater of 4 or the number of CPUs. | `"4"`
74-
| `connectionMaxIdleTime` | N | Output | Max idle time before unused connections are automatically closed in the connection pool. By default, there's no value and this is left to the database driver to choose. | `"5m"`
75-
| `queryExecMode` | N | Output | Controls the default mode for executing queries. By default Dapr uses the extended protocol and automatically prepares and caches prepared statements. However, this may be incompatible with proxies such as PGBouncer. In this case it may be preferrable to use `exec` or `simple_protocol`. | `"simple_protocol"`
76+
| `timeout` | N | Output | Timeout for operations on the database, as a [Go duration](https://pkg.go.dev/time#ParseDuration). Integers are interpreted as number of seconds. Defaults to `20s` | `"30s"`, `30` |
77+
| `maxConns` | N | Output | Maximum number of connections pooled by this component. Set to 0 or lower to use the default value, which is the greater of 4 or the number of CPUs. | `"4"` |
78+
| `connectionMaxIdleTime` | N | Output | Max idle time before unused connections are automatically closed in the connection pool. By default, there's no value and this is left to the database driver to choose. | `"5m"` |
79+
| `queryExecMode` | N | Output | Controls the default mode for executing queries. By default Dapr uses the extended protocol and automatically prepares and caches prepared statements. However, this may be incompatible with proxies such as PGBouncer. In this case it may be preferrable to use `exec` or `simple_protocol`. | `"simple_protocol"` |
7680

7781
### URL format
7882

‎daprdocs/content/en/reference/components-reference/supported-configuration-stores/postgresql-configuration-store.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,28 @@ Authenticating with Microsoft Entra ID is supported with Azure Database for Post
7979
| `azureClientId` | N | Client ID (application ID) | `"c7dd251f-811f-…"` |
8080
| `azureClientSecret` | N | Client secret (application password) | `"Ecy3X…"` |
8181

82+
### Authenticate using AWS IAM
83+
84+
Authenticating with AWS IAM is supported with all versions of PostgreSQL type components.
85+
The user specified in the connection string must be an already existing user in the DB, and an AWS IAM enabled user granted the `rds_iam` database role.
86+
Authentication is based on the AWS authentication configuration file, or the AccessKey/SecretKey provided.
87+
The AWS authentication token will be dynamically rotated before it's expiration time with AWS.
88+
89+
| Field | Required | Details | Example |
90+
|--------|:--------:|---------|---------|
91+
| `useAWSIAM` | Y | Must be set to `true` to enable the component to retrieve access tokens from AWS IAM. This authentication method only works with AWS Relational Database Service for PostgreSQL databases. | `"true"` |
92+
| `connectionString` | Y | The connection string for the PostgreSQL database.<br>This must contain an already existing user, which corresponds to the name of the user created inside PostgreSQL that maps to the AWS IAM policy. This connection string should not contain any password. Note that the database name field is denoted by dbname with AWS. | `"host=mydb.postgres.database.aws.com user=myapplication port=5432 dbname=my_db sslmode=require"`|
93+
| `awsRegion` | Y | The AWS Region where the AWS Relational Database Service is deployed to. | `"us-east-1"` |
94+
| `awsAccessKey` | Y | AWS access key associated with an IAM account | `"AKIAIOSFODNN7EXAMPLE"` |
95+
| `awsSecretKey` | Y | The secret key associated with the access key | `"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"` |
96+
| `awsSessionToken` | N | AWS session token to use. A session token is only required if you are using temporary security credentials. | `"TOKEN"` |
97+
8298
### Other metadata options
8399

84100
| Field | Required | Details | Example |
85101
|--------------------|:--------:|---------|---------|
86102
| `table` | Y | Table name for configuration information, must be lowercased. | `configtable`
103+
| `timeout` | N | Timeout for operations on the database, as a [Go duration](https://pkg.go.dev/time#ParseDuration). Integers are interpreted as number of seconds. Defaults to `20s` | `"30s"`, `30` |
87104
| `maxConns` | N | Maximum number of connections pooled by this component. Set to 0 or lower to use the default value, which is the greater of 4 or the number of CPUs. | `"4"`
88105
| `connectionMaxIdleTime` | N | Max idle time before unused connections are automatically closed in the connection pool. By default, there's no value and this is left to the database driver to choose. | `"5m"`
89106
| `queryExecMode` | N | Controls the default mode for executing queries. By default Dapr uses the extended protocol and automatically prepares and caches prepared statements. However, this may be incompatible with proxies such as PGBouncer. In this case it may be preferrable to use `exec` or `simple_protocol`. | `"simple_protocol"`

‎daprdocs/content/en/reference/components-reference/supported-state-stores/setup-postgresql-v1.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,22 @@ Authenticating with Microsoft Entra ID is supported with Azure Database for Post
8383
| `azureClientId` | N | Client ID (application ID) | `"c7dd251f-811f-…"` |
8484
| `azureClientSecret` | N | Client secret (application password) | `"Ecy3X…"` |
8585

86+
### Authenticate using AWS IAM
87+
88+
Authenticating with AWS IAM is supported with all versions of PostgreSQL type components.
89+
The user specified in the connection string must be an already existing user in the DB, and an AWS IAM enabled user granted the `rds_iam` database role.
90+
Authentication is based on the AWS authentication configuration file, or the AccessKey/SecretKey provided.
91+
The AWS authentication token will be dynamically rotated before it's expiration time with AWS.
92+
93+
| Field | Required | Details | Example |
94+
|--------|:--------:|---------|---------|
95+
| `useAWSIAM` | Y | Must be set to `true` to enable the component to retrieve access tokens from AWS IAM. This authentication method only works with AWS Relational Database Service for PostgreSQL databases. | `"true"` |
96+
| `connectionString` | Y | The connection string for the PostgreSQL database.<br>This must contain an already existing user, which corresponds to the name of the user created inside PostgreSQL that maps to the AWS IAM policy. This connection string should not contain any password. Note that the database name field is denoted by dbname with AWS. | `"host=mydb.postgres.database.aws.com user=myapplication port=5432 dbname=my_db sslmode=require"`|
97+
| `awsRegion` | Y | The AWS Region where the AWS Relational Database Service is deployed to. | `"us-east-1"` |
98+
| `awsAccessKey` | Y | AWS access key associated with an IAM account | `"AKIAIOSFODNN7EXAMPLE"` |
99+
| `awsSecretKey` | Y | The secret key associated with the access key | `"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"` |
100+
| `awsSessionToken` | N | AWS session token to use. A session token is only required if you are using temporary security credentials. | `"TOKEN"` |
101+
86102
### Other metadata options
87103

88104
| Field | Required | Details | Example |

‎daprdocs/content/en/reference/components-reference/supported-state-stores/setup-postgresql-v2.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,22 @@ Authenticating with Microsoft Entra ID is supported with Azure Database for Post
8383
| `azureClientId` | N | Client ID (application ID) | `"c7dd251f-811f-…"` |
8484
| `azureClientSecret` | N | Client secret (application password) | `"Ecy3X…"` |
8585

86+
### Authenticate using AWS IAM
87+
88+
Authenticating with AWS IAM is supported with all versions of PostgreSQL type components.
89+
The user specified in the connection string must be an already existing user in the DB, and an AWS IAM enabled user granted the `rds_iam` database role.
90+
Authentication is based on the AWS authentication configuration file, or the AccessKey/SecretKey provided.
91+
The AWS authentication token will be dynamically rotated before it's expiration time with AWS.
92+
93+
| Field | Required | Details | Example |
94+
|--------|:--------:|---------|---------|
95+
| `useAWSIAM` | Y | Must be set to `true` to enable the component to retrieve access tokens from AWS IAM. This authentication method only works with AWS Relational Database Service for PostgreSQL databases. | `"true"` |
96+
| `connectionString` | Y | The connection string for the PostgreSQL database.<br>This must contain an already existing user, which corresponds to the name of the user created inside PostgreSQL that maps to the AWS IAM policy. This connection string should not contain any password. Note that the database name field is denoted by dbname with AWS. | `"host=mydb.postgres.database.aws.com user=myapplication port=5432 dbname=my_db sslmode=require"`|
97+
| `awsRegion` | Y | The AWS Region where the AWS Relational Database Service is deployed to. | `"us-east-1"` |
98+
| `awsAccessKey` | Y | AWS access key associated with an IAM account | `"AKIAIOSFODNN7EXAMPLE"` |
99+
| `awsSecretKey` | Y | The secret key associated with the access key | `"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"` |
100+
| `awsSessionToken` | N | AWS session token to use. A session token is only required if you are using temporary security credentials. | `"TOKEN"` |
101+
86102
### Other metadata options
87103

88104
| Field | Required | Details | Example |

0 commit comments

Comments
 (0)