Logflare / logflare / 35025521771-1

83%

Build Type

push

github

Committed by web-flow

Commit Message

feat(repo): authenticate PostgreSQL with AWS RDS IAM tokens (#3903)

* feat(repo): authenticate read replicas with RDS IAM tokens

A replica URI may now carry `auth=iam` instead of a password. Each connection
then authenticates with a freshly minted RDS IAM token.

Per connection is the whole point rather than an implementation detail. The
entry is parsed once at boot and a token lasts 15 minutes, so anything minted at
pool start would leave the pool unable to reconnect after that window.
DBConnection's `:configure` runs before every connect attempt, which is exactly
the hook that shape needs. Any inherited configure hook runs first so unrelated
dynamic connection options remain intact.

This is what an AWS endpoint requires when its database role holds `rds_iam`:
per AWS, that grant makes IAM authentication *replace* password authentication
for the role rather than supplement it, so no password can work.

The signing region comes from the AWS-issued
`*.<region>.rds.amazonaws.com` hostname. Aliases and tunnel endpoints are
rejected because AWS validates the signed host. Note ExAws is configured with
`:rds` while the SigV4 signing service is `rds-db` -- ExAws has no `rds-db`
service and raises trying to build a host for one; only the signing name needs
to be `rds-db`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(repo): harden RDS IAM replica connections

* docs(config): label read replica environment setting

* refactor(repo): share AWS IAM connection configuration

* fix(repo): start ExAws before IAM migrations

* fix(repo): preserve replica TLS options

* fix(repo): omit empty AWS session tokens

* fix(repo): inherit TLS for password replicas

* fix(repo): enforce IAM TLS after configure callbacks

* fix(repo): apply IAM auth to direct database clients

* fix(repo): align epgsql IAM connection identity

* fix(repo): preserve inherited replica TLS identity

* fix(repo): bound cluster strategy connection pool

* test(repo)... (continued)

Coverage Stats

126 of 143 new or added lines in 6 files covered. (88.11%)

1 existing line in 1 file now uncovered.

15090 of 18266 relevant lines covered (82.61%)

1673.18 hits per line