mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
602f5a470b
for #1817 # Details This PR gives Fleet servers the ability to connect to RDS MySQL and Elasticache Redis via AWS [Identity and Access Management (IAM)](https://aws.amazon.com/iam/). It is based almost entirely on the work of @titanous, branched from his [original pull request](https://github.com/fleetdm/fleet/pull/31075). The main differences between his branch and this are: 1. Removal of auto-detection of AWS region (and cache name for Elasticache) in favor of specifying these values in configuration. The auto-detection is admittedly handy but parsing AWS host URLs is not considered a best practice. 2. Relying on the existence of these new configs to determine whether or not to connect via IAM. This sidesteps a thorny issue of whether to try an IAM-based Elasticache connection when a password is not supplied, since this is technically a valid setup. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually - besides using @titanous's excellent test tool, I verified the following end-to-end: - [X] regular (non RDS) MySQL connection - [X] RDS MySQL connection using username/password - [X] RDS MySQL connection using IAM (no role) - [X] RDS MySQL connection using IAM (assuming role) - [X] regular (non Elasticache) Redis connection - [X] Elasticache Redis connection using username/password - [X] Elasticache Redis connection using NO password (without IAM) - [X] Elasticache Redis connection using IAM (no role) - [X] Elasticache Redis connection using IAM (assuming role) --------- Co-authored-by: Jonathan Rudenberg <jonathan@titanous.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
33 lines
No EOL
787 B
Markdown
33 lines
No EOL
787 B
Markdown
# RDS IAM Authentication Test Tools
|
|
|
|
This directory contains test tools for validating Fleet's AWS RDS IAM authentication implementation.
|
|
|
|
## Prerequisites
|
|
|
|
- AWS CLI configured with appropriate credentials (via `AWS_PROFILE` or `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`)
|
|
|
|
## Usage
|
|
|
|
### Deploy Test Environment
|
|
|
|
```bash
|
|
# Set AWS credentials and region
|
|
export AWS_PROFILE=your-profile # or use AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
|
|
export AWS_REGION=us-east-2
|
|
|
|
./deploy-test-env.sh
|
|
```
|
|
|
|
This will:
|
|
- Create all RDS instances with IAM authentication enabled
|
|
- Create an EC2 instance with necessary IAM permissions
|
|
- Create database users for IAM authentication
|
|
- Output connection information
|
|
|
|
### Clean Up
|
|
|
|
```bash
|
|
./cleanup-test-env.sh
|
|
```
|
|
|
|
This will destroy the AWS resources. |