RDS Proxy(PSQL) - IAM Identity Center

0

I have seen various articles about RDS proxy access using the traditional IAM. In my case, I'm managing users via AWS SSO(identity center). How can I give the users access to RDS databases without creating a PSQL username/password? I'm using an RDS proxy.

2 Respuestas
0

Hello.

IAM authentication via RDS Proxy should be the same procedure as connecting to an RDS instance, so the IAM policy used should be the same.
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy-setup.html#rds-proxy-connecting

Therefore, I think it is necessary to link the following policy to the IAM Identity Center user.
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html


{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
             "rds-db:connect"
         ],
         "Resource": [
             "arn:aws:rds-db:us-east-2:1234567890:dbuser:db-ABCDEFGHIJKL01234/db_user"
         ]
      }
   ]
}
            
profile picture
EXPERTO
respondido hace 7 meses
0

To use allow IAM Identity Centre Users to connect to the RDS proxy or database you will need to create a new permission set (or update an old one) to include a IAM policy which allows access to the RDS proxy/ DB instance. Then you will need to assign users to that permission set in the AWS account.

This is a bit messy as Role-Based access is generic, so you can either use the full proxy/database ARN the policy (to create a permission set specific to an AWS account) or the something like the following to allow access to all RDS Instances in the account.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds-db:connect"
            ],
            "Resource": [
                "arn:aws:rds-db:us-east-2:1234567890:dbuser:*/*"
            ]
        }
    ]
}

Reference: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html#UsingWithRDS.IAMDBAuth.IAMPolicy.Attaching

respondido hace 7 meses

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas