grafana / grafana/redshift-datasource
Can't use `redshift-data:statement-owner-iam-userid` due to auto-generated session name
- Dominant language
- TypeScript
- Stars
- 19
- Forks
- 10
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 3
Description
**What happened**:
Plugin can't be used with recommended[^1] IAM permissions condition like[^2]:
```json
"Condition": {
"StringEquals": {
"redshift-data:statement-owner-iam-userid": "${aws:userid}"
}
}
```
[^1]: https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.html#redshift-policy-resources.required-permissions.query-editor
[^2]: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftdataapi.html#amazonredshiftdataapi-redshift-data_statement-owner-iam-userid
Because role session name is autogenerated with timestamp in it, which is part of `aws:userid` property [^3]
[^3]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids
**What you expected to happen**:
I expect grafana to be able to describe executed statement, when IAM condition `"redshift-data:statement-owner-iam-userid": "${aws:userid}"` is used.
**How to reproduce it (as minimally and precisely as possible)**:
Setup Grafana Redshift datasource with following permissions:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"redshift-data:ListTables",
"redshift-data:ListSchemas",
"redshift-data:ListDatabases",
"redshift-data:ExecuteStatement",
"redshift-data:DescribeTable"
],
"Effect": "Allow",
"Resource": "arn:aws:redshift-serverless:us-west-2:123456789012:workgroup/123-123-123-123-123",
"Sid": "RedshiftDataApiScoped"
},
{
"Action": [
"redshift-data:ListStatements",
"redshift-data:GetStatementResult",
"redshift-data:DescribeStatement",
"redshift-data:CancelStatement"
],
"Condition": {
"StringEquals": {
"redshift-data:statement-owner-iam-userid": "${aws:userid}"
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "RedshiftDataApiUnscoped"
},
{
"Action": "redshift-serverless:GetCredentials",
"Effect": "Allow",
"Resource": "arn:aws:redshift-serverless:us-west-2:123456789012:workgroup/123-123-123-123-123",
"Sid": "RedshiftServerlessGetCredentials"
},
{
"Action": "redshift-serverless:ListWorkgroups",
"Effect": "Allow",
"Resource": "*",
"Sid": "RedshiftServerlessListWorkgroups"
}
]
}
```
**Anything else we need to know?**:
**Environment**:
- Grafana version: 12.3.x
- Plugin version: 2.5.0
- OS Grafana is installed on: Linux
- User OS & Browser:
- Others:
Contributor guide
Assessment
This issue has not been assessed yet.