Integrate AWS IAM role based authentication to the AWS PostgreSQL JDBC driver

[polarctos]

Currently the Aurora documentation only covers IAM role based authentication via a couple of programmatic steps using the AWS SDK.

Most often you would like to be able to configure database access via a connection string only.

It would be great to have IAM based authentication already integrated into this AWS provided JDBC driver.

There is an existing open source implementation for that purpose:
https://github.com/magJ/iam-jdbc-driver

Another inspiration is the MariaDB JDBC driver, that actually integrates it natively:
https://mariadb.com/kb/en/mariadb-connector-j-250-release-notes/#aws-iam

If IAM based authentication is possible, I guess the Secrets Manager workaround would not be needed additionally.

[adalevinAWS]

Thank you for the suggestion. We will evaluate this for the roadmap.

[polarctos]

There is also already a discussion directly in pgjdbc about extensible authentication mechanisms. But so far this is not yet available in the base driver.

pgjdbc/pgjdbc#2102

But I still think something fully AWS IAM specific in this JDBC driver would be great to have.
E.g. defaulting to the AWS IAM role of the EC2 instance or the service account based IAM role of the pod in AWS EKS with minimal configurations.

[luc-rovio]

Glad to see this was in a September commit. Will this be released to Maven soon? This would be very useful.
Thanks!

[hsuamz]

Hello @luc-rovio,

Thanks for reaching out! There are some additional fixes that we want to include in the next release. We're aiming to provide another update to Maven in the coming week or two.

Thanks,

Matthew

[polarctos]

The version 0.2.0 was now tagged! 🎉

Will this version also be pushed to Maven Central?

[hsuamz]

Hello @polarctos,

For visibility, we're holding off on releasing an official 0.2.0 binary on Maven Central. The PostgreSQL community looks to be introducing an Authentication Plugin Interface and we want to follow the community's approach here. There will be some changes required with the current implementation to conform to that interface. Are you able to use the 0.2.0 tag to make a build and use that in your project?

For some additional context, we've released Enhanced Failover Monitoring with our MySQL driver. These have benefits when using the driver alongside Aurora and these changes will be adapted to our driver as well.

Our focus will be with our PostgreSQL driver now and we're looking to provide more frequent releases and have IAM authentication and Enhanced Failover Monitoring to follow a plugin approach.

Thanks,

Matthew

[davecramer]

@hsuamz So are you guys happy with our implementation? We are implementing this in a vacuum so it would be good to get feedback from someone who will actually use it.

[hsuamz]

Hello @davecramer,

Thanks for reaching out. We see the feature has been committed to mainline as of Dec 28. With prior discussions last Summer, we started thinking about a plugin approach as well and your approach looks good to us. We had some issues initially and was about to reach out with a potential solution, but there was a solution regarding the properties that was included in another branch from sehrope that addressed it.

Once we're able to finalize the plugin implementation, we'll share additional feedback that might come up.

Thanks,

Matthew

[davecramer]

@hsuamz Glad to hear it is usable. I'm considering this a proof of concept at this point. Which may be subject to change.

Let me know if we need to change anything.

Cheers,
Dave