grafana / grafana/redshift-datasource

Can't use `redshift-data:statement-owner-iam-userid` due to auto-generated session name

Open
#836 0 comments 0 reactions 0 assignees View on GitHub
datasource/Redshift type/bug
Dominant language
TypeScript
Stars
19
Forks
10
Avg merge
1d 7h
Merged PRs (30d)
3

Description

**What happened**:

Plugin can't be used with recommended[^1] IAM permissions condition like[^2]:
```json
"Condition": {
"StringEquals": {
"redshift-data:statement-owner-iam-userid": "${aws:userid}"
}
}
```

[^1]: https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.html#redshift-policy-resources.required-permissions.query-editor
[^2]: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftdataapi.html#amazonredshiftdataapi-redshift-data_statement-owner-iam-userid

Because role session name is autogenerated with timestamp in it, which is part of `aws:userid` property [^3]

Image

[^3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids

**What you expected to happen**:

I expect grafana to be able to describe executed statement, when IAM condition `"redshift-data:statement-owner-iam-userid": "${aws:userid}"` is used.

**How to reproduce it (as minimally and precisely as possible)**:

Setup Grafana Redshift datasource with following permissions:

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"redshift-data:ListTables",
"redshift-data:ListSchemas",
"redshift-data:ListDatabases",
"redshift-data:ExecuteStatement",
"redshift-data:DescribeTable"
],
"Effect": "Allow",
"Resource": "arn:aws:redshift-serverless:us-west-2:123456789012:workgroup/123-123-123-123-123",
"Sid": "RedshiftDataApiScoped"
},
{
"Action": [
"redshift-data:ListStatements",
"redshift-data:GetStatementResult",
"redshift-data:DescribeStatement",
"redshift-data:CancelStatement"
],
"Condition": {
"StringEquals": {
"redshift-data:statement-owner-iam-userid": "${aws:userid}"
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "RedshiftDataApiUnscoped"
},
{
"Action": "redshift-serverless:GetCredentials",
"Effect": "Allow",
"Resource": "arn:aws:redshift-serverless:us-west-2:123456789012:workgroup/123-123-123-123-123",
"Sid": "RedshiftServerlessGetCredentials"
},
{
"Action": "redshift-serverless:ListWorkgroups",
"Effect": "Allow",
"Resource": "*",
"Sid": "RedshiftServerlessListWorkgroups"
}
]
}
```

**Anything else we need to know?**:

**Environment**:

- Grafana version: 12.3.x
- Plugin version: 2.5.0
- OS Grafana is installed on: Linux
- User OS & Browser:
- Others:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.