IRSA based secure DB connectivity for WFX

[NallasivanK]

Description

currently WFX supports Postgres Database connectivity based on username, password. in my product, we run all services including WFX in EKS and rest of the services are already connected to RDS based on IRSA .. but in case WFX it could not connect as it does not support IRSA based connectivity.. is it possible to support it.. and is there any other workaround till then to support database connectivity.

Motivation

DB Connectivity based on IRSA for WFX for secure connectivity.

Proposed Solution (optional)

No response

[michaeladler]

Hi @NallasivanK,

I think it's possible, as discussed in issue jackc/pgx#676 (resolved by jackc/pgx@210a217). Since I don't have an AWS playground to experiment with this, I would appreciate a code contribution, like a working PoC. Do you think you could do that?

[NallasivanK]

IRSA based RDS connectivity for WFX

How It Works

1. When IAM authentication is enabled, wfx creates a custom database connector
2. For each new connection, the connector:
   • Resolves any CNAME to the actual RDS endpoint
   • Extracts the AWS region from the endpoint
   • Generates a fresh IAM authentication token (valid for 15 minutes)
   • Establishes the connection using the token
3. The database connection pool automatically creates new connections with fresh tokens as needed

attached the sample code for the same.

pg_irsa.zip

[NallasivanK]

Hi @NallasivanK,

I think it's possible, as discussed in issue jackc/pgx#676 (resolved by jackc/pgx@210a217). Since I don't have an AWS playground to experiment with this, I would appreciate a code contribution, like a working PoC. Do you think you could do that?

Hi @NallasivanK,

I think it's possible, as discussed in issue jackc/pgx#676 (resolved by jackc/pgx@210a217). Since I don't have an AWS playground to experiment with this, I would appreciate a code contribution, like a working PoC. Do you think you could do that?

Hi @michaeladler : updated sample code for IRSA connectivity here