Support AWS RDS IAM Authentication for Redash database by winebarrel · Pull Request #7694 · getredash/redash

winebarrel · 2026-04-17T04:36:11Z

What type of PR is this?

Description

This will enable the use of AWS RDS IAM authentication with Redash Database.
see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html

Using IAM authentication allows you to connect to the database more securely than with password authentication.

How is this tested?

Unit tests (pytest, jest)
E2E Tests (Cypress)
Manually
N/A

I added the following settings and confirmed that I could connect to the RDS for testing.

compose.yaml

  # REDASH_DATABASE_URL: "postgresql://postgres@postgres/postgres"
  REDASH_DATABASE_URL: "postgresql://iam_user@database-1.cluster-xxx.ap-northeast-1.rds.amazonaws.com/postgres"
  AWS_DEFAULT_REGION: ap-northeast-1
  REDASH_DATABASE_AWS_IAM_AUTH: "true"

.env

# NOTE: It is not a required environment variable.
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...

postgres=> select * from pg_stat_activity where usename = 'iam_user';
-[ RECORD 1 ]----+------------------------------
datid            | 5
datname          | postgres
pid              | 4432
leader_pid       |
usesysid         | 16455
usename          | iam_user
application_name |
client_addr      | xxx.xxx.xxx.xxx
client_hostname  |
client_port      | 55457
backend_start    | 2026-04-17 04:31:30.253999+00
xact_start       |
query_start      | 2026-04-17 04:34:25.004999+00
state_change     | 2026-04-17 04:34:25.005079+00
wait_event_type  | Client
wait_event       | ClientRead
state            | idle
backend_xid      |
backend_xmin     |
query_id         |
query            | ROLLBACK
backend_type     | client backend
-[ RECORD 2 ]----+------------------------------
datid            | 5
...

Related Tickets & Documents

Support AWS RDS IAM Authentication for Redash database #7302

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

N/A

cubic-dev-ai

No issues found across 4 files

- upstream migrated Poetry -> uv (removed poetry.lock, added uv.lock) - moved boto3/botocore from all_ds group to main [project].dependencies - regenerated uv.lock

greptile-apps · 2026-08-01T06:51:32Z

Greptile Summary

This PR adds opt-in support for AWS RDS IAM authentication for Redash's own metadata database (not for query runner data sources), controlled by the REDASH_DATABASE_AWS_IAM_AUTH environment variable.

A module-level boto3.client("rds") singleton (_RDS_CLIENT) is created once when IAM auth is enabled, and a SQLAlchemy do_connect listener on the Engine class injects a freshly generated IAM token as the connection password for every new physical connection.
The boto3 import is guarded inside the if settings.REDASH_DATABASE_AWS_IAM_AUTH block, keeping it optional (installed via the all_ds extras) so non-AWS deployments are unaffected.
The version bump in uv.lock reflects the feature addition (26.7.0.dev0 → 26.8.0.dev0).

Confidence Score: 5/5

Safe to merge — the change is narrow and opt-in, touching only the metadata DB connection path when REDASH_DATABASE_AWS_IAM_AUTH=true.
The implementation is clean: the boto3 client is created once as a module-level singleton, the do_connect hook correctly injects a fresh IAM token only at physical connection time (not on pool checkout), and the import is properly lazy-guarded so non-AWS installs are unaffected. All concerns raised in earlier review rounds have been resolved or consciously accepted with documented rationale.
No files require special attention.

Important Files Changed

Filename	Overview
redash/models/base.py	Adds the IAM auth hook: a module-level RDS client singleton and a `do_connect` listener that injects a fresh token as the password on each new physical connection. Boto3 import is correctly lazy-guarded. SSL handling is intentionally left to the operator per project policy.
redash/settings/init.py	Adds `REDASH_DATABASE_AWS_IAM_AUTH` boolean setting parsed from the `REDASH_DATABASE_AWS_IAM_AUTH` env var, defaulting to `false`. Clean, minimal addition.
uv.lock	Lock file updated to reflect the version bump from `26.7.0.dev0` to `26.8.0.dev0`. No dependency changes introduced.

Sequence Diagram

sequenceDiagram
    participant App as Redash App
    participant SQA as SQLAlchemy Pool
    participant Hook as do_connect Hook
    participant RDS_API as AWS RDS API
    participant DB as RDS PostgreSQL

    App->>SQA: Request DB connection
    SQA->>Hook: do_connect event (new physical connection)
    Hook->>RDS_API: generate_db_auth_token(host, port, user)
    RDS_API-->>Hook: IAM auth token (valid 15 min)
    Hook->>Hook: "cparams["password"] = token"
    SQA->>DB: "psycopg2.connect(..., password=token)"
    DB-->>SQA: Connection established
    SQA-->>App: Pooled connection returned

_{Reviews (8): Last reviewed commit: "Merge branch 'master' into support-rds-i..." | Re-trigger Greptile}

boto3.client("rds") was instantiated inside the do_connect hook, so a new client (endpoint resolution, credential chain lookup, config parsing) was built on every physical DB connection. Hoist it to a module-level RDS_CLIENT singleton and close over it, leaving only generate_db_auth_token per connection.

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="redash/models/base.py">

<violation number="1" location="redash/models/base.py:49">
P1: RQ worker jobs inherit this boto3 client across forks, which can cause incorrect response ordering and intermittent RDS token-generation or database-connection failures. Creating the client lazily after the fork (or otherwise once per worker process) preserves the connection reuse without sharing a client across processes.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

RDS IAM DB authentication requires the token to be sent over an encrypted channel. Default sslmode to 'require' in the do_connect hook (via setdefault, so an operator-configured stricter mode like verify-full is preserved).

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="redash/models/base.py">

<violation number="1" location="redash/models/base.py:61">
P1: IAM authentication can still attempt a non-encrypted connection when `REDASH_DATABASE_URL` specifies `sslmode=disable` (or another non-strict mode), because `setdefault` only handles a missing key. Preserve only `verify-ca`/`verify-full`; set every other value to `require`.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

Instead of promoting boto3/botocore to top-level dependencies (which adds the full AWS SDK to every install), keep them in the optional all_ds group and import boto3 lazily inside the REDASH_DATABASE_AWS_IAM_AUTH guard. Enabling IAM auth now requires installing the all_ds extras (or boto3 directly).

setdefault only covered a missing sslmode, so an explicit weak mode in REDASH_DATABASE_URL (e.g. sslmode=disable/prefer) would let IAM auth attempt an unencrypted connection. Force sslmode=require for anything other than the stricter verify-ca/verify-full.

cubic-dev-ai

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pyproject.toml">

<violation number="1">
P2: With boto3 moved out of the core dependencies, a base (non-all_ds) install enabling REDASH_DATABASE_AWS_IAM_AUTH will crash at startup with a bare ImportError, because base.py imports boto3 unguarded. The Postgres/Athena runners guard the same import with try/except (IAM_ENABLED flag), so consider guarding base.py's import too and failing with a clear message (or requiring all_ds) instead of a hard crash.</violation>
</file>

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic}

Don't force sslmode in the do_connect hook. SSL is not an intrinsic requirement of IAM auth (it's controlled server-side by rds.force_ssl), sslmode is static connection config rather than something the hook needs to set, and forcing it would override an operator's explicit choice. Leave transport security to the DB URL and rds.force_ssl.

It's an internal detail of the connection hook with no external references; mark it private to match the file's convention (e.g. _gfk_types).

greptile-apps · 2026-08-09T22:33:42Z

Want your agent to iterate on Greptile's feedback? Try greploops.

cubic-dev-ai Bot reviewed Apr 17, 2026

View reviewed changes

winebarrel mentioned this pull request Apr 18, 2026

Support AWS RDS IAM Authentication for PostgreSQL data soruce #7695

Open

10 tasks

Support AWS RDS IAM Authentication for Redash database

3cb352b

winebarrel force-pushed the support-rds-iam-auth-for-redash-db branch from 584229f to 3cb352b Compare April 18, 2026 04:26

Merge upstream/master, resolve conflicts for RDS IAM auth

4f31d01

- upstream migrated Poetry -> uv (removed poetry.lock, added uv.lock) - moved boto3/botocore from all_ds group to main [project].dependencies - regenerated uv.lock

greptile-apps Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread redash/models/base.py

Comment thread redash/models/base.py Outdated

Comment thread pyproject.toml Outdated

greptile-apps Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread redash/models/base.py

cubic-dev-ai Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread redash/models/base.py Outdated

Enforce SSL for RDS IAM auth connections

37fb69d

RDS IAM DB authentication requires the token to be sent over an encrypted channel. Default sslmode to 'require' in the do_connect hook (via setdefault, so an operator-configured stricter mode like verify-full is preserved).

cubic-dev-ai Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread redash/models/base.py Outdated

winebarrel added 2 commits August 1, 2026 16:16

cubic-dev-ai Bot reviewed Aug 1, 2026

View reviewed changes

winebarrel added 3 commits August 1, 2026 16:34

Make RDS IAM client module-private (_RDS_CLIENT)

41c3d4e

It's an internal detail of the connection hook with no external references; mark it private to match the file's convention (e.g. _gfk_types).

Merge branch 'master' into support-rds-iam-auth-for-redash-db

dffd998

Navigation Menu

Uh oh!

Support AWS RDS IAM Authentication for Redash database - #7694

Support AWS RDS IAM Authentication for Redash database#7694
winebarrel wants to merge 9 commits into
getredash:masterfrom
winebarrel:support-rds-iam-auth-for-redash-db

winebarrel commented Apr 17, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

greptile-apps Bot commented Aug 1, 2026 •

edited

Loading

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

greptile-apps Bot commented Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

winebarrel commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

Description

How is this tested?

Related Tickets & Documents

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

winebarrel commented Apr 17, 2026 •

edited

Loading

greptile-apps Bot commented Aug 1, 2026 •

edited

Loading