bkozora / redshift-authorizer

Temporary federated Redshift authentication using AWS Parameter Store and IAM roles

Redshift Authorizer

Overview

This package utilizes AWS SSM Parameter Store and federated authentication to Redshift via IAM to retrieve temporary and secure Redshift credentials. It then initiates a connection to Redshift using the pg-promise library.

Requirements

• An AWS IAM role with permission to call the GetClusterCredentials action
  • https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html
• Redshift connection information (minus a password) stored in SSM Parameter Store
  • https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-cli.html

Usage

const RedshiftAuthorizer = require('redshift-authorizer')

// Following suggested convention, prefix environment to your parameter names
const prefix = `/${process.env.NODE_ENV || 'production'}`

const db = RedshiftAuthorizer.getDbConnection(`${prefix}/redshift`)
  .then(db => db.any('SELECT usesysid FROM pg_user LIMIT 1', [true]))
  .then(console.log)
  .catch(console.error)

Resources

• Federated Redshift User Authentication
• AWS Param Store
• GetClusterCredentials

Contributors

• Aaron Held
• Bobby Kozora