Redshift Authorizer

Overview

This package utilizes AWS SSM Parameter Store and federated authentication to Redshift via IAM to retrieve temporary and secure Redshift credentials. It then initiates a connection to Redshift using the pg-promise library.

Requirements

• An AWS IAM role with permission to call the GetClusterCredentials action
  • https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html
• Redshift connection information (minus a password) stored in SSM Parameter Store
  • https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-cli.html

Usage

const RedshiftAuthorizer = require('redshift-authorizer')

// Following suggested convention, prefix environment to your parameter names
const prefix = `/${process.env.NODE_ENV || 'production'}`

const db = RedshiftAuthorizer.getDbConnection(`${prefix}/redshift`)
  .then(db => db.any('SELECT usesysid FROM pg_user LIMIT 1', [true]))
  .then(console.log)
  .catch(console.error)

Resources

• Federated Redshift User Authentication
• AWS Param Store
• GetClusterCredentials

Contributors

• Aaron Held
• Bobby Kozora