Support for AWS IAM authentication

[cici925]

Hi folks,

I'm not sure if this is on the roadmap - do you want to add support for AWS IAM integration? We're using AWS RDS for our services. It would be great if you can support AWS IAM integration for us to better develop in the AWS ecosystem.

[petere]

What exactly would "AWS IAM integration" mean?

[benchub]

AWS IAM authentication allows a client to generate a short-lived token for a specific db and db role, and then provide that instead of a password. For example, we are considering using auth_query on a pgBouncer connecting to RDS, but instead of having that auth_user provide a password, it would be nice if pgBouncer could use the AWS API (or spawn a cli command) that generates this token.

[JelteF]

How short lived are these tokens? i.e. could you have a cron job that updates PgBouncer its config every ~1 hour with a new token as the password?

Also, to be clear. You are not talking about PgBouncer supporting clients that authenticate with these tokens, but instead you want PgBouncer to generate a token and then use that to authenticate to the server?

[benchub]

Tokens are valid for 15 minutes.

I don't know about @cici925 , but for us, yes, I am talking about pgBouncer generating a token to use for its auth_user connection. We are planning to use full SSL cert authentication to validate clients connecting to pgBouncer are who they say they are.

[JelteF]

hmm, 15 minutes is definitely an annoying number. Seems quite often to reload your pgbouncer config. I wouldn't be extremely opposed to have a "auth_command" config option (at database and global level) that would get a password for a user using a shell command instead of a SQL query.

Implementing AWS API handling ourselves seems like a no-go though (given the amount of code required). But if there's some shared library we can optionally link to, then I wouldn't mind that either.

I'm not going to work on this myself though, but I'd be happy to review some changes that make this flow work for you.

[benchub]

Yeah, having an auth_command is the only thing that makes sense to me - embedding AWS-specific logic in pgBouncer seems very much the wrong thing.

That said this isn't enough of an itch for me to make it happen either. :)