Support for Credentials Provider

[moreandres]

Hi!

AWS has recently added IAM integration (role-based access instead of passwords) to ElastiCache Redis Clusters.

Amazon ElastiCache for Redis - Authenticating with IAM

It seems the client should periodically refresh a token to be used as a password for new connections.

I would appreciate any guidance on how to integrate a credential provider as recommended above.

Thanks!

[servlette]

Will this feature be supported anytime soon in V9 or V8?

[monkey92t]

I'm not familiar with AmazonElastiCache, but reading the documentation, my understanding is as follows:

1. Obtain IAM authentication token from aws (valid for 15 minutes). You need to implement this method yourself, go-redis does not have this method.
2. Use IAM authentication token to send authentication information to ElastiCache
3. After passing the authentication, the network connection will be valid for 12 hours (if the connection is not disconnected)
4. After 12 hours (or the connection is disconnected), we need to reacquire the IAM authentication token and authenticate (steps 1 and 2)

If I understand nothing wrong, it is used in go-redis as follows:

rdb := redis.NewClient(&redis.Options{
        Addr: ":6379",
        CredentialsProvider: func() (username string, password string) {
                userID, iamAuthToken := iamAuth(.....)
                return userID, iamAuthToken
        },
})

@moreandres @servlette
I'm not sure if this will work because I can't test it with AmazonElastiCache, can you give it a try?

[PrayAnalog]

Finally, I can use Elasticache through IAM. Thanks.

I try to write IAMAuthTokenRequest like https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth-iam.html
And here's my code.

package elasticache

import (
	"context"
	"net/http"
	"net/url"
	"strconv"
	"strings"
	"time"

	"github.com/aws/aws-sdk-go-v2/aws"
	signer "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
)

const (
	REQUEST_PROTOCOL     = "http://"
	PARAM_ACTION         = "Action"
	PARAM_USER           = "User"
	ACTION_NAME          = "connect"
	SERVICE_NAME         = "elasticache"
	PARAM_EXPIRES        = "X-Amz-Expires"
	TOKEN_EXPIRY_SECONDS = 899

	EMPTY_BODY_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" // the hex encoded SHA-256 of an empty string
)

type IAMAuthTokenRequest struct {
	userID             string
	replicationGroupId string
	region             string
}

func (i *IAMAuthTokenRequest) toSignedRequestUri(credential aws.Credentials) (string, error) {
	req, err := i.getSignableRequest()
	if err != nil {
		return "", err
	}

	signedURI, _, err := i.sign(req, credential)
	if err != nil {
		return "", err
	}

	u, err := url.Parse(signedURI)
	if err != nil {
		return "", err
	}

	res := url.URL{
		Scheme:   "http",
		Host:     u.Host,
		Path:     "/",
		RawQuery: u.RawQuery,
	}

	return strings.Replace(res.String(), REQUEST_PROTOCOL, "", 1), nil
}

func (i *IAMAuthTokenRequest) getSignableRequest() (*http.Request, error) {
	query := url.Values{
		PARAM_ACTION:  {ACTION_NAME},
		PARAM_USER:    {i.userID},
		PARAM_EXPIRES: {strconv.FormatInt(int64(TOKEN_EXPIRY_SECONDS), 10)},
	}

	signUrl := url.URL{
		Scheme:   "http",
		Host:     i.replicationGroupId,
		Path:     "/",
		RawQuery: query.Encode(),
	}

	req, err := http.NewRequest(http.MethodGet, signUrl.String(), nil)
	if err != nil {
		return nil, err
	}

	return req, nil
}

func (i *IAMAuthTokenRequest) sign(req *http.Request, credential aws.Credentials) (signedURI string, signedHeaders http.Header, err error) {
	s := signer.NewSigner()
	return s.PresignHTTP(context.TODO(), credential, req, EMPTY_BODY_SHA256, SERVICE_NAME, i.region, time.Now())
}

And, I apply it like this

client := redis.NewClient(&redis.Options{
	Addr:     "your-elasticache-endpoint",
	CredentialsProvider: func() (string, string) {
		username := "your-user-name"
		iamAuthTokenRequest := IAMAuthTokenRequest{
			userID:             username,
			replicationGroupId: "your-replication-group-id",
			region:             "your-region-like-ap-northeast-2",
		}

		iamAuthToken, err := iamAuthTokenRequest.toSignedRequestUri(aws.Credentials{
			AccessKeyID:     "your-iam-access-key",
			SecretAccessKey: "your-iam-secret-key",
		})

		if err != nil {
			logrus.Error(err)
			return "", ""
		}

		return username, iamAuthToken
	},
	TLSConfig: &tls.Config{
		InsecureSkipVerify: true,
	},
})

You can check replication-group-id with aws-cli tools.
I hope this can help who try to connect with IAM.

[monkey92t]

good!