feat: add IAM authentication support to normal Postgres (i.e. for AWS RDS Postgres)

[ndom91]

Changes

• Primarily added support for IAM Authentication based on ~/.aws/credentials profiles for RDS Postgres.
• I initially tried to rename the redshiftOptions to iamOptions to make it more general, but had issues with the migration on the sqlite db in relation to detecting if a column exists and has a certain name and only if thats true, rename it. So I just (mis)used redshiftOptions directly for this Postgres IAM auth as well 😅
• Added @aws-sdk/* to vue's transpileDependencies because newer features like nulllish coalescing inside those packages was breaking the build, I guess this electron version is on a slightly older version of node(?)

Notes

• Moved all TS/ESLint fix ups to this PR.
• See this issue thread for more details: FEAT: IAM Support for AWS RDS (Postgres) #1443

Screenshot

[ndom91]

Okay I see why TS was not setup correctly 😅

I just spent ~1hr fixing all the TS errors, its all in that last commit. I understand if you're not comfortable pushing all that in this one PR though, I can revert that last commit and disable TS/eslint again if you prefer.

I did do a good deal of clicking around and testing things though and it does all seem to still work.

Many of the ts errors were related to misuse of @ts-ignore and empty/unused methods, so shouldn't have runtime affects anyway.

[rathboma]

@ndom91 Thanks for the PR and for fixing a big issue with our dev setup.

Can I ask a favor - can you split this into 2 PRs? 1 to fix the IAM issue, and the other to fix eslint and tsconfig?

That way I can better manage the large changeset with my other devs.

[rathboma]

Also - is there a way to avoid these types of template changes?

This is a stylistic change that I think just makes it harder to merge:

Totally happy to merge a PR or lint and typescript fixes without the style stuff. I don't even mind the style stuff, but it's just going to make our outstanding feature branches totally broken.

[ndom91]

Also - is there a way to avoid these types of template changes?

This is a stylistic change that I think just makes it harder to merge:

Totally happy to merge a PR or lint and typescript fixes without the style stuff. I don't even mind the style stuff, but it's just going to make our outstanding feature branches totally broken.

Yeah I was nervous about y'all declining these changes haha, but afaik they were just the default vue formatting rules yall had setup being applied again. I can take a look though.

In regard to splitting it up, yeah no problem. Makes sense 👍

[ndom91]

@rathboma okay so I've cleaned up and split all the TS/ESLint changes into their own PR.

However, I'm travelling currently for the next few days and only have my M1 MBP on me. I wasn't able to get beekeeper-studio to build or even install locally due to node-gyp / binary errors relating to better-sqlite3 and not being able to find arm binaries for it :/

Anyway, so I wasn't abel to thoroughly test these two PRs atm, but they shuold be good to go. Can you give them a shot? Or I can do it next weekend when I'm back home on my x86 desktop 👍

[rathboma]

This looks amazing! I need to figure out how to set up my aws credentials to test it :-).

if you have the link to a guide for setting up an rds instance with iam auth that would be very helpful!

[MasterOdin]

@rathboma This doc https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html does a good job walking you through it I think. Enumerating out the steps / subsections from that is:

1. Make sure you have IAM auth enabled for the RDS instance (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html)
2. That the AWS user you wish to use has the right permission policy attached to them to allow RDS auth (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html)
3. That you've created a DB user and have granted rds_iam to that user (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html#UsingWithRDS.IAMDBAuth.DBAccounts.PostgreSQL)

[MasterOdin]

I think that you should have a dropdown on both the redshift and postgres pages (and this would be true also for mysql in the future) that when using AWS IAM, you can either:

1. Use a profile
2. Use credentials

Both the RedshiftClient that underlies redshift auth and the Signer that underlies postgres support the credentials being passed as an object with access key and secret access key, as well as support receiving credentials loaded via fromIni.

[ndom91]

I think that you should have a dropdown on both the redshift and postgres pages (and this would be true also for mysql in the future) that when using AWS IAM, you can either:

1. Use a profile
2. Use credentials

Both the RedshiftClient that underlies redshift auth and the Signer that underlies postgres support the credentials being passed as an object with access key and secret access key, as well as support receiving credentials loaded via fromIni.

Yeah good point.

I actually initially tried to use the nodeCredentualsProvider which iterates through all aws auth options (env vars, ini, etc.) but the import wasn't working for some reason. See my first PR (can dig out the link tmr). If you can get that working that'd be great.

Also I tried to rename the redshiftOptions to be iamOptions to be more generalized, but had trouble with the sqlite migration - renaming a column only if the column exists and has a certain name. So I ended up just (mis)using redshitOptions for that here again.

I think both of those could be nice follow-up PRs though once the initial support is in!

[ndom91]

@rathboma looks like you can setup an RDS instance with an AWS free tier account!

https://repost.aws/knowledge-center/free-tier-rds-launch

(Note: this PR is for postgres only, right, so that guide needs a bit of modification ^^)

[rathboma]

I'm going to pick this back up and get it tested and updated over the next month or so, along with changes for Redshift.

[SebastiaanSafeguard]

Is there anything we could do to help land this PR?

[rathboma]

@SebastiaanSafeguard Yeah I'm going to have someone on the team look into this issue in the next cycle. We're updating all the drivers right now to a more managable format, so we'll probably just rewrite some of this.