Support for RDS AWS IAM Auth by mish-elle · Pull Request #8084 · graphql-hive/console

mish-elle · 2026-05-26T21:08:35Z

Background

Self-hosters running Hive on AWS with Aurora/RDS PostgreSQL currently have no way to use IAM-based authentication for PostgreSQL connections, which forces them to use static passwords.

This PR adds opt-in AWS IAM authentication support for PostgreSQL connections across services that connect to Postgres.

This PR is part of the following issue. We will have separate PRs for each IAM support to help decrease the scope per PR.

IAM authentication support for Redis, Kafka, S3 and PG #7780

Description

RDS IAM token generation logic lives in a new module inside service-common:

service-common/src/iam-rds.ts: Aurora/RDS-specific IAM token generation using @aws-sdk/rds-signer.

When Postgres IAM auth is enabled:

The service validates IAM prerequisites during environment parsing.
Postgres connection string generation uses a token provider instead of a static password.
A fresh RDS IAM token is generated via signer and used as the connection password.

Implementation notes:

Added a connectionStringProvider in packages/internal/postgres/src/connection-string.ts that returns a fresh connection string on each call.
When a tokenGenerator function is provided, each invocation first calls await tokenGenerator() to fetch a fresh, short-lived RDS IAM token, then builds the connection string with that token as the password.
In postgres-database-pools, we updated createPostgresDatabasePool so that connectionParameters can now be a ConnectionStringProvider function as well.
Added/updated Slonik patches required for dynamic passwords. Slonik has now introduced support for dynamic passwords, so these patches can be removed once the Slonik version is upgraded.
- Support dynamic passwords gajus/slonik#775
Added Docker build support to install the AWS RDS CA bundle for services that connect to RDS. https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html

New environment variables introduced

Name	Required	Description
`AWS_REGION`	No	Default AWS region for the service. Used as fallback for AWS connections.
`POSTGRES_AWS_IAM_AUTH_ENABLED`	No	Set to `1` to enable IAM authentication for Aurora/RDS PostgreSQL.
`POSTGRES_AWS_REGION`	No	Optional override for Postgres IAM region (defaults to `AWS_REGION`).

Environment Variable Validation

When POSTGRES_AWS_IAM_AUTH_ENABLED=1, environment validation enforces:

POSTGRES_SSL=1 (RDS IAM requires TLS)
POSTGRES_AWS_REGION or AWS_REGION must be set

Pnpm-lock file generation

Like previous IAM PRs, CI will require maintainer to help generate lockfile will be needed due to our internal constraints. Thank you!

Checklist

- add IAM token generation for Aurora/RDS PostgreSQL authentication - wire IAM auth configuration through postgres consumers - add tests, docs, and optional RDS CA certificate image support

gemini-code-assist

Code Review

This pull request introduces opt-in AWS RDS IAM authentication for PostgreSQL connections across several services, utilizing short-lived IAM tokens (SigV4) instead of static passwords. It includes updates to Docker configurations, environment variables, Slonik patches, and the introduction of a connection string provider. The review feedback highlights several critical improvements: avoiding direct access to process.env in favor of Zod-parsed configurations, removing unnecessary type assertions, and eliminating the use of the non-null assertion operator (!) outside of test files to prevent potential runtime errors.

gemini-code-assist · 2026-05-26T21:10:50Z

    password: postgres.POSTGRES_PASSWORD,
    ssl: postgres.POSTGRES_SSL === '1',
+    awsIamAuthEnabled: postgres.POSTGRES_AWS_IAM_AUTH_ENABLED === '1',
+    awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,


Avoid accessing process.env directly. Use the parsed environment variable from configs.base.data instead.

Suggested change

awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,

awsRegion: postgres.POSTGRES_AWS_REGION ?? configs.base.data?.AWS_REGION,

References

Do not access process.env directly in your code. Define environment variables in packages/services/*/src/environment.ts using Zod schemas. ^(link)

gemini-code-assist · 2026-05-26T21:10:50Z

    password: postgres.POSTGRES_PASSWORD,
    ssl: postgres.POSTGRES_SSL === '1',
+    awsIamAuthEnabled: postgres.POSTGRES_AWS_IAM_AUTH_ENABLED === '1',
+    awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,


Avoid accessing process.env directly. Use the parsed environment variable from configs.base.data instead.

Suggested change

awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,

awsRegion: postgres.POSTGRES_AWS_REGION ?? configs.base.data?.AWS_REGION,

References

Do not access process.env directly in your code. Define environment variables in packages/services/*/src/environment.ts using Zod schemas. ^(link)

gemini-code-assist · 2026-05-26T21:10:51Z

    password: postgres.POSTGRES_PASSWORD,
    ssl: postgres.POSTGRES_SSL === '1',
+    awsIamAuthEnabled: postgres.POSTGRES_AWS_IAM_AUTH_ENABLED === '1',
+    awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,


Avoid accessing process.env directly. Use the parsed environment variable from configs.base.data instead.

Suggested change

awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,

awsRegion: postgres.POSTGRES_AWS_REGION ?? configs.base.data?.AWS_REGION,

References

Do not access process.env directly in your code. Define environment variables in packages/services/*/src/environment.ts using Zod schemas. ^(link)

gemini-code-assist · 2026-05-26T21:10:51Z

    password: postgres.POSTGRES_PASSWORD,
    ssl: postgres.POSTGRES_SSL === '1',
+    awsIamAuthEnabled: postgres.POSTGRES_AWS_IAM_AUTH_ENABLED === '1',
+    awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,


Avoid accessing process.env directly. Use the parsed environment variable from configs.base.data instead.

Suggested change

awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,

awsRegion: postgres.POSTGRES_AWS_REGION ?? configs.base.data?.AWS_REGION,

References

Do not access process.env directly in your code. Define environment variables in packages/services/*/src/environment.ts using Zod schemas. ^(link)

gemini-code-assist · 2026-05-26T21:10:51Z

    password: postgres.POSTGRES_PASSWORD,
    ssl: postgres.POSTGRES_SSL === '1',
+    awsIamAuthEnabled: postgres.POSTGRES_AWS_IAM_AUTH_ENABLED === '1',
+    awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,


Avoid accessing process.env directly. Use the parsed environment variable from configs.base.data instead.

Suggested change

awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,

awsRegion: postgres.POSTGRES_AWS_REGION ?? configs.base.data?.AWS_REGION,

References

Do not access process.env directly in your code. Define environment variables in packages/services/*/src/environment.ts using Zod schemas. ^(link)

gemini-code-assist · 2026-05-26T21:10:51Z

+  ? () =>
+      generateRdsIamAuthToken(
+        {
+          region: env.postgres.awsRegion!,


Avoid using the non-null assertion operator (!). Use a fallback instead.

region: env.postgres.awsRegion ?? '',

References

Avoid using the non-null assertion operator (!) outside of test files, as it can lead to subtle bugs.

gemini-code-assist · 2026-05-26T21:10:51Z

+      ? () =>
+          generateRdsIamAuthToken(
+            {
+              region: env.postgres.awsRegion!,


Avoid using the non-null assertion operator (!). Use a fallback instead.

Suggested change

region: env.postgres.awsRegion!,

region: env.postgres.awsRegion ?? '',

References

Avoid using the non-null assertion operator (!) outside of test files, as it can lead to subtle bugs.

gemini-code-assist · 2026-05-26T21:10:51Z

+    ? () =>
+        generateRdsIamAuthToken(
+          {
+            region: env.postgres.awsRegion!,


Avoid using the non-null assertion operator (!). Use a fallback instead.

Suggested change

region: env.postgres.awsRegion!,

region: env.postgres.awsRegion ?? '',

References

Avoid using the non-null assertion operator (!) outside of test files, as it can lead to subtle bugs.

gemini-code-assist · 2026-05-26T21:10:51Z

+    ? () =>
+        generateRdsIamAuthToken(
+          {
+            region: env.postgres.awsRegion!,


Avoid using the non-null assertion operator (!). Use a fallback instead.

Suggested change

region: env.postgres.awsRegion!,

region: env.postgres.awsRegion ?? '',

References

Avoid using the non-null assertion operator (!) outside of test files, as it can lead to subtle bugs.

gemini-code-assist · 2026-05-26T21:10:52Z

+    ? () =>
+        generateRdsIamAuthToken(
+          {
+            region: env.postgres.awsRegion!,


Avoid using the non-null assertion operator (!). Use a fallback instead.

Suggested change

region: env.postgres.awsRegion!,

region: env.postgres.awsRegion ?? '',

References

Avoid using the non-null assertion operator (!) outside of test files, as it can lead to subtle bugs.

n1ru4l · 2026-07-17T07:10:03Z

@mish-elle Can you please rebase this on the main branch and incorporate the same general feedback and patterns as in the other PRs around AWS IAM?

mish-elle and others added 3 commits May 26, 2026 16:40

feat: add AWS RDS IAM auth support

7c17b61

- add IAM token generation for Aurora/RDS PostgreSQL authentication - wire IAM auth configuration through postgres consumers - add tests, docs, and optional RDS CA certificate image support

Merge branch 'graphql-hive:main' into rds-iam-auth

2e77d36

chore(docker): enable RDS CA certs for additional services

0926a75

gemini-code-assist Bot reviewed May 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Support for RDS AWS IAM Auth#8084

Support for RDS AWS IAM Auth#8084
mish-elle wants to merge 3 commits into
graphql-hive:mainfrom
mish-elle:rds-iam-auth

mish-elle commented May 26, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

gemini-code-assist Bot May 26, 2026

Uh oh!

n1ru4l commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

	awsRegion: postgres.POSTGRES_AWS_REGION ?? process.env.AWS_REGION,
	awsRegion: postgres.POSTGRES_AWS_REGION ?? configs.base.data?.AWS_REGION,

	region: env.postgres.awsRegion!,
	region: env.postgres.awsRegion ?? '',

Uh oh!

Conversation

mish-elle commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

Description

New environment variables introduced

Environment Variable Validation

Pnpm-lock file generation

Checklist

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 26, 2026

Choose a reason for hiding this comment

Uh oh!

n1ru4l commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

mish-elle commented May 26, 2026 •

edited

Loading