aws / aws/aws-cdk

aws-rds: have aws-rds.DatabaseProxy.grant_connect() add the security group inbound rules

Open
#20,789 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-rds documentation effort/small feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the feature

Have the aws-rds.DabataseProxy.grant_connect() function add security group Ingress rules to the RDS security group if the IGrantable is not in the same SG.

### Use Case

When building an RDS, RDSProxy with IAM authorization, and a Lambda, I used grant_connect(my lambda) to give the lambda the necessary permissions to connect. What I soon discovered is that while it had all the necessary IAM permissions, because the Lambda was using the default auto generated security group, and the RDS/RDSProxy was using its own auto generated, they were not able to actually speak with each other. It was only after I added an inbound rule to the SG of the RDS that allowed the SG of the lambda into it was this able to connect properly.

the naming of `grant_connect` and being able to provide an lambda, implies that the lambda (using the correct code of course from the SDK to retrieve a token) should already be able to connect to the RDS with no additional steps required.

### Proposed Solution

_No response_

### Other Information

Given what I understand in the nature of a Grant object (which is admitted very little) this may not be actually within the scope of grant_connect - Perhaps then a seperate method would be needed and the documentation for this method updated to make it clear that it does not connect security groups?

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.28.1 (build d035432)

### Environment details (OS name and version, etc.)

windows and cloud9 instance

Contributor guide

Open the contributing guide

Research direction

Start by reading the aws-rds DatabaseProxy.grant_connect() implementation and the security-group behavior described in the issue. Compare the current IAM grant with the RDS and Lambda security groups, then clarify whether completion means adding the inbound rule automatically or documenting that a separate step is required.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.