Skip to main content

Django database backends to use AWS Database IAM Authentication

Project description

Django IAM database backends

codecov pypi readthedocs tests

Usage

pip install django-iam-dbauth

In your settings use the following

DATABASES = {
    "default": {
        "HOST": "<hostname>",
        "USER": "<user>",
        "NAME": "<db name>",
        "ENGINE": 'django_iam_dbauth.aws.postgresql',
        "OPTIONS": {
            "use_iam_auth": True,
            "sslmode": "require",   # See discussion on SSL below
            "resolve_cname_enabled": True,
        }
    }
}

SSL and PostgreSQL

When using IAM authentication with RDS, SSL is required. If it's not used, such as when using a CNAME (see below), login will be denied with the below error:

django.db.utils.OperationalError: FATAL:  pg_hba.conf rejects connection for host "1.2.3.4", user "some_user", database "some_database", SSL off

SSL and MySQL

Acquired Token won't work with MySQL if use RDS instance name, which is a CNAME record, as a HOST, because by default it will be resolved to a cannonical name by django-iam-dbauth. As a result the hostname of the token will bi different. To prevent the module from resolving CNAME, set "resolve_cname_enabled" to False.

CNAME considerations

Currently, IAM authentication is not supported with CNAMEs. However, this package does CNAME resolution so that the signed request for a password will work. The issue with this approach is that from the DB library's point of view, the connection is initiated to the hostname as defined in the settings. If using SSL, certificate verification will fail. In this case, for PostgreSQL you may want to set sslmode to require or verify-ca.

Further documentation:

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

django_iam_dbauth-0.2.1.tar.gz (7.3 kB view hashes)

Uploaded Source

Built Distribution

django_iam_dbauth-0.2.1-py2.py3-none-any.whl (5.9 kB view hashes)

Uploaded Python 2 Python 3

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page