gopuff/redshift-authorizer

Temporary federated Redshift authentication using AWS Parameter Store and IAM roles

TypeScript

Redshift Authorizer

Overview

This package utilizes AWS SSM Parameter Store and federated authentication to Redshift via IAM to retrieve temporary and secure Redshift credentials. It then initiates a connection to Redshift using the pg-promise library.

Requirements

An AWS IAM role with permission to call the GetClusterCredentials action
- https://docs.aws.amazon.com/redshift/latest/mgmt/generating-user-credentials.html
Redshift connection information (minus a password) stored in SSM Parameter Store
- https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-cli.html

Usage

const RedshiftAuthorizer = require('redshift-authorizer')

// Following suggested convention, prefix environment to your parameter names
const prefix = `/${process.env.NODE_ENV || 'production'}`

const db = RedshiftAuthorizer.getDbConnection(`${prefix}/redshift`)
  .then(db => db.any('SELECT usesysid FROM pg_user LIMIT 1', [true]))
  .then(console.log)
  .catch(console.error)

Resources

Contributors