feat(db): add IAM authentication#1807
Open
Thegaram wants to merge 3 commits into
Open
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds optional AWS RDS IAM authentication to the ChangesAWS RDS IAM Authentication
Sequence DiagramsequenceDiagram
participant App
participant newDialector as newDialector / openDB
participant NewRDSIAMConnector
participant rdsIAMConnector as rdsIAMConnector.Connect
participant BuildAuthToken as rds/auth.BuildAuthToken
participant pgxstdlib as pgx stdlib
App->>newDialector: InitDB(config) / NewOrmFactory(cfg)
newDialector->>NewRDSIAMConnector: dsn, awsRegion
NewRDSIAMConnector-->>newDialector: connector (driver.Connector)
newDialector->>App: dialector / *sqlx.DB (via sql.OpenDB)
App->>rdsIAMConnector: Connect(ctx) [per connection]
rdsIAMConnector->>BuildAuthToken: endpoint, region, user, creds
BuildAuthToken-->>rdsIAMConnector: IAM token (password)
rdsIAMConnector->>pgxstdlib: Connect(ctx) with token injected
pgxstdlib-->>App: driver.Conn
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #1807 +/- ##
===========================================
+ Coverage 35.31% 35.43% +0.12%
===========================================
Files 260 262 +2
Lines 22426 22523 +97
===========================================
+ Hits 7920 7982 +62
- Misses 13677 13710 +33
- Partials 829 831 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
common/database/iam_test.go (1)
12-91: ⚡ Quick winMissing test for DSN without database user.
The
NewRDSIAMConnectorfunction validates that the DSN specifies a database user (iam.go line 39); however, the test suite does not cover this error path. All DSNs in the tests include an explicit user.✅ Proposed test case to add
t.Run("rejects invalid dsn", func(t *testing.T) { _, err := NewRDSIAMConnector(ctx, "::not a dsn::", "us-east-1") assert.Error(t, err) }) + + t.Run("rejects dsn without user", func(t *testing.T) { + // IAM token signature includes the user; a missing user prevents token generation. + _, err := NewRDSIAMConnector(ctx, + "postgres://mydb.example.rds.amazonaws.com:5432/scroll?sslmode=require", + "us-east-1") + assert.ErrorContains(t, err, "user") + })🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@common/database/iam_test.go` around lines 12 - 91, Add a new test case in TestNewRDSIAMConnector that verifies the function properly rejects DSNs without a database user. Create a t.Run subtest (similar to the existing ones like "rejects invalid dsn") that calls NewRDSIAMConnector with a valid DSN format but with no user specified (for example, a DSN like "postgres://mydb.example.rds.amazonaws.com:5432/scroll?sslmode=require"), and verify that the function returns an error, ensuring the validation mentioned in iam.go line 39 is properly tested.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@common/database/iam_test.go`:
- Around line 12-91: Add a new test case in TestNewRDSIAMConnector that verifies
the function properly rejects DSNs without a database user. Create a t.Run
subtest (similar to the existing ones like "rejects invalid dsn") that calls
NewRDSIAMConnector with a valid DSN format but with no user specified (for
example, a DSN like
"postgres://mydb.example.rds.amazonaws.com:5432/scroll?sslmode=require"), and
verify that the function returns an error, ensuring the validation mentioned in
iam.go line 39 is properly tested.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e2d94c19-781f-4579-8caf-b2104c1afcdc
⛔ Files ignored due to path filters (1)
common/go.sumis excluded by!**/*.sum
📒 Files selected for processing (10)
common/database/config.gocommon/database/db.gocommon/database/iam.gocommon/database/iam_metrics.gocommon/database/iam_test.gocommon/go.modcommon/version/version.godatabase/README.mddatabase/config.godatabase/orm_factory.go
georgehao
previously approved these changes
Jun 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose or design rationale of this PR
This PR adds opt-in AWS RDS/Aurora IAM authentication for Postgres as an alternative to static DSN passwords.
useIAMAuthconfig flag (default off, so existing behavior is unchanged), services authenticate with short-lived IAM tokens regenerated per connection, eliminating manual DB credential rotation.gorm(common/database) andsqlx(database) layers via a sharedpgx-based connector, fails closed on insecure DSNs (rejectssslmode=disable/prefer/allowand multi-host since the token is the password), and exposes Prometheus metrics for token generation.rds_iamon the DB role and anrds-db:connectIAM policy; seedatabase/README.md.Deployment steps, for each service connecting to RDS:
rds-db:connectonarn:aws:rds-db:<region>:<account>:dbuser:<db-resource-id>/svc_user. Attach it to the role the pod assumes via IRSA / Pod Identity, and make sure the ServiceAccount is wired so the SDK's default credential chain (and AWS_REGION) resolve in-cluster.useIAMAuthandawsRegion, drop the password from the DSN and addsslmode=require.Summary by CodeRabbit
New Features
Documentation
useIAMAuthandawsRegion, including required TLS/sslmodeand IAM setup steps.Tests
Chores