hasura / hasura/graphql-engine

Passwordless authentication using IAM authentication to RDS for self-hosted / hybrid hasura plans

Open
#10,208 0 comments 0 reactions 0 assignees View on GitHub
k/enhancement v2
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

**Component**
c/v3-engine

### Is your proposal related to a problem?
This is a new feature request. Currently this functionality is possible with AWS Secrets via https://github.com/hasura/hasura-secret-refresh

Passwordless authentication is not supported presently for IAM authentication to RDS like PostgreSQL

**Solution desired**
What I am looking for is fully passwordless authentication using [ IAM authentication to RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html) for self-hosted / hybrid hasura plans. For example, we should be able to have our hasura pods use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to authenticate to RDS PostgreSQL databases **without having long lived credentials**.

### Describe alternatives you've considered

One option is add a Provider for AWS IAM in this [repo](https://github.com/hasura/hasura-secret-refresh)
The current Providers at this [link](https://github.com/hasura/hasura-secret-refresh/tree/main/provider) are rather limited to AWS Secrets Manager

Similar concept - can we leverage AWS SDK in hasura directly to configure IAM auth as an alternative?

Contributor guide

Open the contributing guide

Research direction

The request targets the c/v3-engine component; start by reading the AWS RDS IAM authentication and EKS IRSA documentation, then compare the existing providers in hasura-secret-refresh. Done means self-hosted and hybrid Hasura pods can authenticate to RDS PostgreSQL through IAM without long-lived credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, postgresql
Domain
authentication, cloud, database
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.