Skip to content

Conversation

@andrew-corbalt
Copy link
Contributor

PR Description

To simplify handling both RDS IAM auth and conventional password auth postgres connections, NewPostgresqlConnectorFromDSN() adds the concept of a custom DSN postgres+rds-iam://@[:]/, which will instruct the function to do down the IAM auth path in setting up a connector. Alternatively, if this function is passed a normal postgres DSN, then a conventional password auth is used.

Tests:
Updated the DSO Metrics Migration method to use NewPostgresqlConnectorFromDSN() and ran it against a test database using both conventional and custom DSN

PR Checklist

  • New automated tests have been written to the extent possible.
  • The code has been checked for structural/syntactic validity.
    • AMI/application: a build was performed
    • terraform changes: "terraform plan" checked on every affected environment
  • (If applicable) the code has been manually tested on our infrastructure.
    • AMI/application: deployed an a test or dev environment
    • terraform changes: applied to test or dev environment
    • script: run against test or dev environment
  • Likely failure points and new functionality have been identified and tested manually.
    Examples:
    • Application manually run in a way that triggers any new branches
    • AMI logged into and changes verified from login shell
  • Pull request description includes a description of all the manual steps performed to accomplish the above.

To provide feedback on this template, visit https://docs.google.com/document/d/1YfTv7Amyop5G_8w1c2GJ_Mu-70L0KkZHhm9f9umDi3U/edit

Copy link

@jonahb jonahb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good. I like the new approach. I guess it'd also be worth thinking about whether we want to tweak things per Slack thread and how this change might fit into that.

// - assume_role_session_name: only used when assume_role_arn is set; defaults to "pgutils-rds-iam" if omitted.
//
// IAM example 2: postgres+rds-iam://<user>@<host>[:<port>]/<dbname>?assume_role_arn=...&assume_role_session_name=...
func NewPostgresqlConnectorFromDSN(ctx context.Context, dsn string) (*PostgresqlConnector, error) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function only accepts URLs (not any DSN / connection string), so I think we should make that clear, e.g.:

func NewPostgresqlConnectorFromURL(ctx context.Context, u *url.URL) (*PostgresqlConnector, error)

We could also provide a helper that parses the URL string (NewPostgresqlConnectorFromURLString).

cfg.AssumeRoleSessionName = q.Get("assume_role_session_name")
}

return NewPostgresqlConnectorWithIAMAuth(ctx, cfg)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems good while clients are changing to connection strings (DSNs), but per engineering sync, the plan is eventually to remove the IAM and connection string-specific constructors.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants