Support AWS RDS IAM Authentication for Redash database

pyproject.toml

@@ -88,15 +88,15 @@ tzlocal = "4.3.1"
 pyodbc = "5.1.0"
 debugpy = "^1.8.9"
 paramiko = "3.4.1"
+boto3 = "1.28.8"
+botocore = "1.31.8"
 
 [tool.poetry.group.all_ds]
 optional = true
 
 [tool.poetry.group.all_ds.dependencies]
 atsd-client = "3.0.5"
 azure-kusto-data = "0.0.35"
-boto3 = "1.28.8"
-botocore = "1.31.8"
 cassandra-driver = "3.21.0"
 certifi = ">=2019.9.11"
 cmem-cmempy = "21.2.3"

redash/models/base.py

@@ -1,7 +1,10 @@
 import functools
 
+import boto3
 from flask_sqlalchemy import BaseQuery, SQLAlchemy
 from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.engine import Engine
+from sqlalchemy.event import listens_for
 from sqlalchemy.orm import object_session
 from sqlalchemy.pool import NullPool
 from sqlalchemy_searchable import SearchQueryMixin, make_searchable, vectorizer
@@ -42,6 +45,21 @@ def apply_pool_defaults(self, app, options):
 make_searchable(db.metadata, options={"regconfig": "pg_catalog.simple"})
 
 
+# IAM database authentication for AWS RDS
+# See https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html
+if settings.REDASH_DATABASE_IAM_AUTH:
+
+    @listens_for(Engine, "do_connect")
+    def db_connect_hook(dialect, conn_rec, cargs, cparams):
+        rds_client = boto3.client("rds")
+        auth_token = rds_client.generate_db_auth_token(
+            DBHostname=cparams["host"],
+            Port=cparams["port"],
+            DBUsername=cparams["user"],
+        )
+        cparams["password"] = auth_token
+
+
 class SearchBaseQuery(BaseQuery, SearchQueryMixin):
     """
     The SQA query class to use when full text search is wanted.

redash/settings/__init__.py

@@ -459,3 +459,6 @@ def email_server_is_configured():
 
 # Email blocked domains, use delimiter comma to separated multiple domains
 BLOCKED_DOMAINS = set_from_string(os.environ.get("REDASH_BLOCKED_DOMAINS", "qq.com"))
+
+# AWS
+REDASH_DATABASE_IAM_AUTH = parse_boolean(os.environ.get("REDASH_DATABASE_IAM_AUTH", "false"))