Add support for DSQL iam authentication #919

leszek-bq · 2025-07-17T22:36:26Z

Summary

Add support for DSQL iam authentication

Description

Created token_utils base class and specific implementation of token generation code for DSQL
Moved the token generation code from the /utils/iam_utils.py to rds specific token_utils implementation
Added a parameter to IamAuthPlugin constructor for the new token_utils and updated the corresponding IamAuthPluginFactory
Created a new DsqlIamAuthPluginFactory
Added example docs/examples/DSQLIamAuthentication.py

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

docs/examples/DSQLIamAuthentication.py

aws_advanced_python_wrapper/utils/rds_token_utils.py

docs/using-the-python-driver/using-plugins/UsingTheDSQLIamAuthenticationPlugin.md

tests/unit/test_iam_dsql_plugin.py

aws_advanced_python_wrapper/federated_plugin.py

aws_advanced_python_wrapper/okta_plugin.py

aws_advanced_python_wrapper/utils/dsql_token_utils.py

aaron-congo · 2025-07-22T19:06:39Z

docs/using-the-python-driver/using-plugins/UsingTheDSQLIamAuthenticationPlugin.md

+
+## Prerequisites
+> [!WARNING]\
+> To preserve compatibility with customers using the community driver, IAM Authentication requires the AWS SDK for Python; [Boto3](https://pypi.org/project/boto3/). Boto3 is a runtime dependency and must be resolved. It can be installed via pip like so: `pip install boto3`.


Suggested change

> To preserve compatibility with customers using the community driver, IAM Authentication requires the AWS SDK for Python; [Boto3](https://pypi.org/project/boto3/). Boto3 is a runtime dependency and must be resolved. It can be installed via pip like so: `pip install boto3`.

> To preserve compatibility with customers using the community driver, IAM Authentication requires the AWS SDK for Python, [Boto3](https://pypi.org/project/boto3/). Boto3 is a runtime dependency and must be resolved. It can be installed via pip like so: `pip install boto3`.

Currently this is the same in the related file:

docs/using-the-python-driver/using-plugins/UsingTheIamAuthenticationPlugin.md

I wonder if the ';' should be changed to ':' rather than ','. It looks like we're not listing several things in this sentence but rather specifying the name of the AWS SDK for Python.

Yeah I think ':' or ',' would make more sense

docs/using-the-python-driver/using-plugins/UsingTheDSQLIamAuthenticationPlugin.md

aaron-congo · 2025-07-22T19:20:50Z

tests/unit/test_iam_dsql_plugin.py

+
+    actual_token = _token_cache.get(f"{_PG_REGION}:{_PG_HOST_INFO.url}:1234:admin")
+    assert _GENERATED_TOKEN == actual_token.token
+    assert actual_token.is_expired() is False


nit, same suggestion for the other lines with this pattern in the file:

Suggested change

assert actual_token.is_expired() is False

assert not actual_token.is_expired()

Updated all the occurrences.

tests/unit/test_iam_dsql_plugin.py

aws_advanced_python_wrapper/utils/dsql_token_utils.py

faviansamatha · 2025-07-22T20:52:16Z

aws_advanced_python_wrapper/utils/rds_token_utils.py

+
+            client.close()
+
+            logger.debug("IamAuthUtils.GeneratedNewAuthToken", token)


Same with this, we should remove it. Ik it was here before but not a good idea to display it as it's part of the credentials.

changed to

logger.debug("TokenUtils.GeneratedNewAuthTokenLength", len(token) if token else 0)

docs/using-the-python-driver/using-plugins/UsingTheDSQLIamAuthenticationPlugin.md

leszek-bq · 2025-07-24T18:29:48Z

Update to e1503c9 rebases to include the #920

Comments have been addressed

tests/integration/container/test_iam_dsql_authentication.py

tests/integration/host/src/test/java/integration/host/TestEnvironment.java

tests/integration/host/src/test/java/integration/host/TestEnvironmentConfiguration.java

aws_advanced_python_wrapper/utils/dsql_token_utils.py

danielfrankcom reviewed Jul 17, 2025

View reviewed changes

docs/examples/DSQLIamAuthentication.py Outdated Show resolved Hide resolved

leszek-bq changed the title ~~WIP Add support for DSQL iam authentication~~ Add support for DSQL iam authentication Jul 22, 2025

danielfrankcom previously requested changes Jul 22, 2025

View reviewed changes

aaron-congo reviewed Jul 22, 2025

View reviewed changes

faviansamatha reviewed Jul 22, 2025

View reviewed changes

aaron-congo approved these changes Jul 24, 2025

View reviewed changes

faviansamatha approved these changes Jul 24, 2025

View reviewed changes

leszekamz added 11 commits July 24, 2025 11:03

Add support for DSQL iam authentication

037ed3c

Fixed errors with updated interfaces for federated and octa plugins.

821750a

flake and isort updates

69a1a5c

isort updates

ed40d71

fixed unit tests

c838379

added DSQL unit tests

737adcf

sorting imports - isort

c52315b

adding iam_dsql plugin documentation

0cc92c5

updated readme.md

b1f2180

addressing code review comments

cf805a8

addressing more code review comments

e1503c9

leszek-bq force-pushed the dsql_iam branch from f412e7e to e1503c9 Compare July 24, 2025 18:24

leszekamz added 2 commits July 28, 2025 13:36

Added integration tests for dsql and updated relevant files

ab49fbc

merge with main

268d816

aaron-congo reviewed Jul 29, 2025

View reviewed changes

tests/integration/container/test_iam_dsql_authentication.py Outdated Show resolved Hide resolved

aaron-congo reviewed Jul 29, 2025

View reviewed changes

tests/integration/host/src/test/java/integration/host/TestEnvironment.java Outdated Show resolved Hide resolved

aaron-congo reviewed Jul 29, 2025

View reviewed changes

tests/integration/host/src/test/java/integration/host/TestEnvironmentConfiguration.java Outdated Show resolved Hide resolved

karenc-bq reviewed Jul 30, 2025

View reviewed changes

aws_advanced_python_wrapper/utils/dsql_token_utils.py Show resolved Hide resolved

leszekamz added 3 commits July 30, 2025 17:49

addressing code review comments

fc9df7e

Removed unused method in test

300b0ff

Removed unused import in test

f0ad4da

aaron-congo approved these changes Jul 31, 2025

View reviewed changes

	> To preserve compatibility with customers using the community driver, IAM Authentication requires the AWS SDK for Python; [Boto3](https://pypi.org/project/boto3/). Boto3 is a runtime dependency and must be resolved. It can be installed via pip like so: `pip install boto3`.
	> To preserve compatibility with customers using the community driver, IAM Authentication requires the AWS SDK for Python, [Boto3](https://pypi.org/project/boto3/). Boto3 is a runtime dependency and must be resolved. It can be installed via pip like so: `pip install boto3`.

	assert actual_token.is_expired() is False
	assert not actual_token.is_expired()


		client.close()

		logger.debug("IamAuthUtils.GeneratedNewAuthToken", token)

Add support for DSQL iam authentication #919

Are you sure you want to change the base?

Add support for DSQL iam authentication #919

Uh oh!

Conversation

leszek-bq commented Jul 17, 2025

Summary

Description

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aaron-congo Jul 22, 2025

Choose a reason for hiding this comment

Uh oh!

leszek-bq Jul 23, 2025

Choose a reason for hiding this comment

Uh oh!

aaron-congo Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aaron-congo Jul 22, 2025

Choose a reason for hiding this comment

Uh oh!

leszek-bq Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

faviansamatha Jul 22, 2025

Choose a reason for hiding this comment

Uh oh!

leszek-bq Jul 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

leszek-bq commented Jul 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!