aws / aws/amazon-redshift-python-driver
Support 'external_id' for temporary credentials
- 主要語言
- Python
- 星號
- 220
- 分支
- 86
- PR 合併指標
- 30 天內沒有已合併 PR
描述
## Driver version
v2.0.907 [Latest](https://github.com/aws/amazon-redshift-python-driver/releases/latest)
## Redshift version
N/A
## Client Operating System
N/A
## Python version
N/A
## Table schema
N/A
## Problem description
1. Expected behaviour: Library is able to use EKS IRSA / AWS SSO to discovery credential, then use `AssumeRole` with `role_arn` and `external_id` to receive current one.
2. Actual behaviour: No support for `external_id`.
4. Error message/stack trace: N/A
5. Any other details that can be helpful:
Partner Hosted Foundational Technical Review requires "CAA-002 - Use external ID with cross-account roles to access customer accounts."
Credential management is already supported. In my opinion, AWS SDK (in this scenario `boto3`) defines the credentials standard for IAM that is adopted for language in AWS. In my opinion, this library should only receive instance `boto3.Session` to build proper IAM credentials on its own. It allows use `aws-assume-role-lib` ( https://github.com/benkehoe/aws-assume-role-lib ) to automatically refresh credentials when reconnection happens (The fact that it is an external library is a separate problem in boto3 because [JavaScript](https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/TemporaryCredentials.html) / Java ( https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/auth/STSAssumeRoleSessionCredentialsProvider.html ) has the appropriate built-in credential provider.). Then a large amount of code - repeated in relation to boto3 - regarding the use of credential management will become redundant.
## Python Driver trace logs
## Reproduction code
```python
import redshift_connector
# Connects to Redshift cluster using AWS credentials
conn = redshift_connector.connect(
host='examplecluster.abc123xyz789.us-west-1.redshift.amazonaws.com',
database='dev',
user='awsuser',
role_arn='aws:...',
external_id='...'
)
```
CC: @podpio
貢獻指南
研究方向
從 redshift_connector.connect 範例開始,追蹤如何取得 role_arn 憑證。檢查所要求的 boto3.Session 和 AssumeRole 流程,包括 external_id 以及重新連線時的憑證重新整理。完成的標準是連接器接受用於暫時憑證的 external_id,且文件化的重現流程能夠正常運作。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- aws, python
- 領域
- authentication, cloud, databases
- Issue 類型
- 功能
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 停滯
- 描述清晰度
- 基本清楚
- 新手友好度
- 38/100