Connect to Azure postgres from Fargate service

To connect from an AWS Fargate service to Azure PostgreSQL flexible servers, you can use a similar approach to the AWS STS method, but with some adjustments for Azure integration. Here's a high-level overview of how you can achieve this:

1. Create a managed identity in Azure: Set up an Azure managed identity that will be associated with your Fargate service. This identity will be used to authenticate and obtain temporary access tokens.

2. Configure Azure PostgreSQL: Enable Azure Active Directory authentication for your PostgreSQL flexible servers and grant the necessary permissions to the managed identity you created.

3. Set up cross-cloud authentication: Create an IAM role in AWS that can be assumed by the Azure managed identity. This role should have a trust relationship with an identity provider that supports SAML 2.0 or OpenID Connect, such as Azure AD.

4. Obtain temporary credentials: In your Fargate service, implement logic to acquire an Azure AD token using the managed identity. Then, use AWS Security Token Service (STS) to exchange this token for temporary AWS credentials.

5. Generate database access token: Use the temporary AWS credentials to call a custom AWS Lambda function or API Gateway endpoint that can generate a temporary access token for your Azure PostgreSQL database.

6. Connect to the database: Use the generated temporary access token to establish a connection to your Azure PostgreSQL flexible server from your Fargate service.

For implementing this in Go, you can use the Azure SDK for Go to interact with Azure services and obtain the necessary tokens. The github.com/Azure/azure-sdk-for-go package provides libraries for Azure resource management and authentication.

To fetch the temporary access token, you would use the Azure Identity library in Go to authenticate and obtain an access token from Azure AD. Then, use the AWS SDK for Go to assume the IAM role and get temporary AWS credentials.

While this approach requires setting up cross-cloud authentication and may involve additional components like Lambda functions or API Gateway, it allows you to maintain a centralized application in AWS Fargate while securely connecting to Azure PostgreSQL servers using temporary credentials.
Sources
How to access AWS resources from Microsoft Entra ID tenants using AWS Security Token Service | AWS Security Blog
Call AWS API from external | AWS re:Post

Hello Community,

To address your need for password-less connection from AWS Fargate to Azure PostgreSQL using Microsoft Entra ID, the solution on the AWS side involves setting up Workload Identity Federation. This allows your Fargate task to securely obtain credentials that Microsoft Entra ID will trust, without you having to manage long-lived secrets in AWS for Azure authentication.

In this model, a JWT token provided by an Identity Provider (IdP), such as Microsoft Entra ID, is used to authenticate an AssumeRoleWithWebIdentity API call. This call then allows temporary AWS credentials to be vended from a specific AWS role that trusts the OIDC identity.

Therefore, if you are able to expose the JWT from Entra ID within the Fargate environment to call the AssumeRoleWithWebIdentity API, this solution should be possible.

Regarding your second query, it's fair to say that from the AWS side, no new actions are required beyond what was already outlined for the first query (setting up the IAM Role and OIDC provider for Workload Identity Federation). The question specifically asks about Azure "managed identity" creation and the Go library for token fetching, both of which are primarily Azure/SDK concerns once the initial cross-cloud trust is established. Therefore, I suggest raising this query with Azure Support, as they have more expertise to address your issue in detail.

I hope the above information is helpful.