Add RDS IAM auth plugin for SQL drivers (#2830)

Signed-off-by: Alexander Mays <[email protected]>
Added:
A new environment variable to the CLI: SQL_AUTH_PLUGIN=rds-iam-auth
A new flag arg to the CLI: --sql-auth-plugin rds-iam-auth
2 new docker template variables: authPlugin: {{ default .Env.SQL_AUTH_PLUGIN "" }} and authPlugin: {{ default .Env.SQL_VIS_AUTH_PLUGIN "" }}
A new SQL configuration attribute authPlugin

Makefile

@@ -423,7 +423,7 @@ start-cdc-other: temporal-server
 	./temporal-server --zone other start
 
 ##### Mocks #####
-AWS_SDK_VERSION := $(lastword $(shell grep "github.com/aws/aws-sdk-go" go.mod))
+AWS_SDK_VERSION := $(lastword $(shell grep "github.com/aws/aws-sdk-go v1" go.mod))
 external-mocks:
 	@printf $(COLOR) "Generate external libraries mocks..."
 	@mockgen -copyright_file ./LICENSE -package mocks -source $(GOPATH)/pkg/mod/github.com/aws/aws-sdk-go@$(AWS_SDK_VERSION)/service/s3/s3iface/interface.go | grep -v -e "^// Source: .*" > common/archiver/s3store/mocks/S3API.go

common/config/config.go

@@ -320,6 +320,15 @@ type (
 		TaskScanPartitions int `yaml:"taskScanPartitions"`
 		// TLS is the configuration for TLS connections
 		TLS *auth.TLS `yaml:"tls"`
+		// AuthPlugin is the configuration for a SQL authentication plugin
+		// - currently drivers 'mysql' and 'postgres' support 'rds-iam-auth'
+		AuthPlugin *SQLAuthPlugin `yaml:"authPlugin"`
+	}
+
+	// SQLAuthPlugin determines which sql auth plugin is invoked for each new SQL session
+	SQLAuthPlugin struct {
+		Plugin  string        `yaml:"plugin"`
+		Timeout time.Duration `yaml:"timeout"`
 	}
 
 	// CustomDatastoreConfig is the configuration for connecting to a custom datastore that is not supported by temporal core

common/persistence/sql/sqlplugin/auth/auth_plugin.go

@@ -0,0 +1,57 @@
+// The MIT License
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+//go:generate mockgen -copyright_file ../../../../../LICENSE -package $GOPACKAGE -source $GOFILE -destination auth_plugin_mock.go
+package auth
+
+import (
+	"context"
+	"errors"
+
+	"go.temporal.io/server/common/config"
+)
+
+var (
+	ErrInvalidAuthPluginName = errors.New("auth_plugin: invalid auth plugin requested")
+	plugins                  = map[string]AuthPlugin{}
+)
+
+type (
+	// AuthPlugin interface for mutating SQL connection parameters
+	AuthPlugin interface {
+		// GetConfig returns a mutated SQL config
+		GetConfig(context.Context, *config.SQL) (*config.SQL, error)
+	}
+)
+
+// RegisterPlugin adds an auth plugin to the plugin registry
+// it is only safe to use from a package init function
+func RegisterPlugin(name string, plugin AuthPlugin) {
+	plugins[name] = plugin
+}
+
+func LookupPlugin(name string) (AuthPlugin, error) {
+	plugin, ok := plugins[name]
+	if !ok {
+		return nil, ErrInvalidAuthPluginName
+	}
+
+	return plugin, nil
+}

common/persistence/sql/sqlplugin/auth/rds_auth_plugin.go

@@ -0,0 +1,159 @@
+// The MIT License
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+package auth
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"io/ioutil"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	AWSConfig "github.com/aws/aws-sdk-go-v2/config"
+	AWSAuth "github.com/aws/aws-sdk-go-v2/feature/rds/auth"
+
+	"go.temporal.io/server/common/auth"
+	"go.temporal.io/server/common/config"
+)
+
+const defaultTimeout = time.Second * 10
+const rdsCaUrl = "https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem"
+
+var rdsAuthFn = AWSAuth.BuildAuthToken
+
+func init() {
+	RegisterPlugin("rds-iam-auth", NewRDSAuthPlugin(nil))
+}
+
+func fetchRdsCA(ctx context.Context) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, defaultTimeout)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, "GET", rdsCaUrl, nil)
+	if err != nil {
+		return "", err
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+
+	defer resp.Body.Close()
+	pem, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+
+	return base64.StdEncoding.EncodeToString(pem), nil
+}
+
+type RDSAuthPlugin struct {
+	awsConfig        *aws.Config
+	rdsPemBundle     string
+	initRdsPemBundle sync.Once
+}
+
+func NewRDSAuthPlugin(awsConfig *aws.Config) AuthPlugin {
+	return &RDSAuthPlugin{
+		awsConfig: awsConfig,
+	}
+}
+
+func (plugin *RDSAuthPlugin) getToken(ctx context.Context, addr string, region string, user string, credentials aws.CredentialsProvider) (string, error) {
+	reqCtx, cancel := context.WithTimeout(ctx, defaultTimeout)
+	defer cancel()
+
+	return rdsAuthFn(reqCtx, addr, region, user, credentials)
+}
+
+func (plugin *RDSAuthPlugin) resolveAwsConfig(ctx context.Context) (*aws.Config, error) {
+	if plugin.awsConfig != nil {
+		return plugin.awsConfig, nil
+	}
+
+	reqCtx, cancel := context.WithTimeout(ctx, defaultTimeout)
+	defer cancel()
+
+	cfg, err := AWSConfig.LoadDefaultConfig(reqCtx)
+	if err != nil {
+		return nil, err
+	}
+
+	return &cfg, nil
+}
+
+func (plugin *RDSAuthPlugin) GetConfig(ctx context.Context, cfg *config.SQL) (*config.SQL, error) {
+	awsCfg, err := plugin.resolveAwsConfig(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	token, err := plugin.getToken(ctx, cfg.ConnectAddr, awsCfg.Region, cfg.User, awsCfg.Credentials)
+	if err != nil {
+		return nil, err
+	}
+
+	cfg.Password = token
+	cfg.ConnectProtocol = "tcp"
+
+	if cfg.ConnectAttributes == nil {
+		cfg.ConnectAttributes = map[string]string{}
+	}
+
+	// mysql requires this plugin to use the token as a password
+	if cfg.PluginName == "mysql" {
+		cfg.ConnectAttributes["allowCleartextPasswords"] = "true"
+	}
+
+	// if TLS is not configured, we default to the RDS CA
+	// this is required for mysql to send cleartext passwords
+	if cfg.TLS == nil {
+		var fetchErr error
+		plugin.initRdsPemBundle.Do(func() {
+			ca, err := fetchRdsCA(ctx)
+			if err != nil {
+				fetchErr = err
+				return
+			}
+
+			plugin.rdsPemBundle = ca
+		})
+
+		if fetchErr != nil {
+			return nil, fetchErr
+		}
+
+		if plugin.rdsPemBundle == "" {
+			return nil, errors.New("rds_auth_plugin: unable to retrieve rds ca certificates")
+		}
+
+		cfg.TLS = &auth.TLS{
+			Enabled: true,
+			CaData:  plugin.rdsPemBundle,
+		}
+	}
+
+	return cfg, nil
+}