aws / aws/amazon-redshift-jdbc-driver

Serverless with temporary IAM credentials fails when using a Redshift managed VPC endpoint

Open
#137 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
71
Forks
42
PR merge metrics
No merged PRs in 30d

Description

**Infrastructure:**
* VPC (db) containing production databases and Redshift serverless instance (ddi)
* VPC (cl) containing VPN client end point and management boxes
* Redshift managed endpoint in (cl)

*Moving either the cluster or VPN end point is not an option.*

**Initial testing:**
Using my laptop on the VPN and using the AWS CLI to generate temporary credentials I am able to use SQL Workbench to connect to (ddi) and run queries using the JDBC URL:
`jdbc:redshift://ddi-endpoint-endpoint-k7rfausgmlzieup51zgg.[account].eu-west-1.redshift-serverless.amazonaws.com:5439/:dev`
if I provide the temporary credentials to SQL Workbench via copy-paste.

**Where I hit a problem:**
If I change the URL to:
`jdbc:redshift:iam://ddi-endpoint-endpoint-k7rfausgmlzieup51zgg.[account].eu-west-1.redshift-serverless.amazonaws.com:5439/:dev`
(note the addition of `iam:`) I get this error:

```
IAM error retrieving temp credentials: Serverless workgroup ddi-endpoint-endpoint-k7rfausgmlzieup51zgg not found.
(Service: AWSRedshiftServerless; Status Code: 400; Error Code: ResourceNotFoundException; Request ID: [redacted]; Proxy: null)
[SQL State=99999]
```

Having looked at the codebase it appears (although I am very much not a Java developer) that the IAM temporary credentials provider is assuming that the first part of the URL is the workgroup name and therefore won't correctly pick up

**Questions:**
* Is this a know issue?
* If so:
* * is it on a roadmap to look at?
* * is there a temporary fix
* If not, is my diagnosis correct or have I done something silly that you can point me in the direction of.

All help appreciated.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the JDBC URL IAM temporary credentials provider, focusing on how it derives the serverless workgroup name from the managed VPC endpoint. Reproduce the failure with the documented JDBC URLs and confirm the expected behavior for the Redshift serverless endpoint before identifying a suitable regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
cloud, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.