AWS IAM DB authentication (RDS/Aurora)

​

Setup

​

Before you start

​

Make sure IAM authentication is enabled

1. Login to your AWS Account and navigate to the RDS instance you want to configure.
2. Click on the Modify button.
3. Scroll down to the Database authentication section.
4. Enable the Password and IAM database authentication option.
5. Click on the Continue button.
6. Review the changes and click on the Apply immediately option.

​

Setting up the database user

• AWS Aurora for PostgreSQL source setup guide
• AWS RDS for PostgreSQL source setup guide
• AWS Aurora for MySQL source setup guide
• AWS RDS for MySQL source setup guide

​

Obtaining the ClickHouse service IAM role Arn

​

Setting up the IAM role

​

Obtaining the RDS/Aurora Resource ID

1. Login to your AWS Account and navigate to the RDS instance/Aurora Cluster you want to configure.
2. Click on the Configuration tab.
3. Note the Resource ID value. It should look like db-xxxxxxxxxxxxxx for RDS or cluster-xxxxxxxxxxxxxx for Aurora cluster. Let’s call this value {RDS_RESOURCE_ID}. This is the resource ID that will be used in the IAM policy to allow access to the RDS instance.

​

Manually create IAM role.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "{ClickHouse_IAM_ARN}"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds-db:connect"
      ],
      "Resource": [
        "arn:aws:rds-db:{RDS_REGION}:{AWS_ACCOUNT}:dbuser:{RDS_RESOURCE_ID}/clickpipes_iam_user"
      ]
    }
  ]
}