feat: Auth token generator for AWS DSQL #1857

sichanyoo · 2025-01-07T17:53:40Z

Issue #

2297

Description of changes

Adds DSQL auth token generation capability

New/existing dependencies impact assessment, if applicable

Conventional Commits

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…tRuntime to generate token for DSQL. Update comments to account for both RDS and DSQL.

sichanyoo

Comments to help reviews

sichanyoo · 2025-01-08T16:52:49Z

Sources/Services/AWSDSQL/Sources/AWSDSQL/AuthTokenGenerator.swift

@@ -0,0 +1,77 @@
+//


This is the generated auth token generator for DSQL service. Included for reference.

sichanyoo · 2025-01-08T16:53:17Z

...software/amazon/smithy/aws/swift/codegen/customization/dsql/AuthTokenGeneratorIntegration.kt

@@ -0,0 +1,94 @@
+package software.amazon.smithy.aws.swift.codegen.customization.dsql


This is the codegen integration for generating auth token generator for DSQL.

sichanyoo · 2025-01-08T16:53:50Z

.../software/amazon/smithy/aws/swift/codegen/customization/rds/AuthTokenGeneratorIntegration.kt

@@ -68,7 +68,7 @@ class AuthTokenGeneratorIntegration : SwiftIntegration {
                    username: String,


Modifies codegen integration for RDS auth token generation to use modified function name in runtime auth token generator

sichanyoo · 2025-01-08T16:54:10Z

Sources/Services/AWSRDS/Sources/AWSRDS/AuthTokenGenerator.swift

@@ -52,7 +52,7 @@ public class AuthTokenGenerator {
        username: String,


This is the generated diff for RDS auth token generator

sichanyoo · 2025-01-08T16:54:32Z

Sources/Core/AWSClientRuntime/Sources/AWSClientRuntime/Customizations/AuthTokenGenerator.swift

@@ -16,7 +16,7 @@ import SmithyIdentity
 import struct Foundation.Date


This file is the underlying auth token generator in runtime library, used by RDS and DSQL service auth token generators.

dayaffe · 2025-01-08T19:03:25Z

...software/amazon/smithy/aws/swift/codegen/customization/dsql/AuthTokenGeneratorIntegration.kt

+            val authTokenGeneratorWrapperClass = """
+            @_spi(AuthTokenGenerator) import class AWSClientRuntime.AuthTokenGenerator
+            import SmithyIdentity
+            import struct Foundation.TimeInterval
+
+            /// A utility class with methods that generate IAM authentication token used for connecting to DSQL.
+            public class AuthTokenGenerator {
+                private let generator: AWSClientRuntime.AuthTokenGenerator
+
+                /// The initializer that takes in AWSCredentialIdentity struct to use to generate the IAM authentication token.
+                public init(awsCredentialIdentity: AWSCredentialIdentity) {
+                    self.generator = AWSClientRuntime.AuthTokenGenerator(awsCredentialIdentity: awsCredentialIdentity)
+                }
+
+                /// The initializer that takes in a specific AWSCredentialIdentityResolver, used to resolve the AWSCredentialIdentity used to generate the IAM authentication token.
+                public init(awsCredentialIdentityResolver: any AWSCredentialIdentityResolver) async throws {
+                    self.generator = try await AWSClientRuntime.AuthTokenGenerator(awsCredentialIdentityResolver: awsCredentialIdentityResolver)
+                }
+
+                /// Updates the AWS credentials used to generate the IAM auth token.
+                public func updateCredentials(newAWSCredentialIdentity: AWSCredentialIdentity) {
+                    generator.updateCredentials(newAWSCredentialIdentity: newAWSCredentialIdentity)
+                }
+
+                /// Updates the AWS credentials used to generate the IAM auth token by resolving credentials from passed in resolver.
+                public func updateCredentials(awsCredentialIdentityResolver: any AWSCredentialIdentityResolver) async throws {
+                    try await generator.updateCredentials(awsCredentialIdentityResolver: awsCredentialIdentityResolver)
+                }
+
+                /// Generates authenetication token for non-admin connection using given inputs to the method and credential identity instance variable.
+                ///
+                /// - Parameters:
+                ///   - endpoint: The endpoint of the RDS instance. E.g., `peccy.dsql.us-east-1.on.aws`
+                ///   - region: The region that RDS instance is located in. E.g., `us-east-1`
+                ///   - expiration: The expiration for the token in seconds. Default is 900 seconds (15 minutes).
+                public func generateDBConnectAuthToken(
+                    endpoint: String,
+                    region: String,
+                    expiration: TimeInterval = 900
+                ) async throws -> String {
+                    return try await generator.generateDSQLAuthToken(
+                        endpoint: endpoint,
+                        region: region,
+                        expiration: expiration,
+                        isForAdmin: false
+                    )
+                }
+
+                /// Generates authenetication token for admin connection using given inputs to the method and credential identity instance variable.
+                ///
+                /// - Parameters:
+                ///   - endpoint: The endpoint of the RDS instance. E.g., `peccy.dsql.us-east-1.on.aws`
+                ///   - region: The region that RDS instance is located in. E.g., `us-east-1`
+                ///   - expiration: The expiration for the token in seconds. Default is 900 seconds (15 minutes).
+                public func generateDBConnectAdminAuthToken(
+                    endpoint: String,
+                    region: String,
+                    expiration: TimeInterval = 900
+                ) async throws -> String {
+                    return try await generator.generateDSQLAuthToken(
+                        endpoint: endpoint,
+                        region: region,
+                        expiration: expiration,
+                        isForAdmin: true
+                    )
+                }
+            }
+            """.trimIndent()
+            writer.write(authTokenGeneratorWrapperClass)


I don't love this... ideally we would generate as little as possible. But since we already do it like this for the RDS token we can take up a refactor if one is possible later on

deepakscomk · 2025-01-08T20:22:18Z

Sources/Core/AWSClientRuntime/Sources/AWSClientRuntime/Customizations/AuthTokenGenerator.swift

+
+        // Remove https:// from the presigned URL to get final value for RDS auth token.
+        let startIndex = presignedURL.absoluteString.index(presignedURL.absoluteString.startIndex, offsetBy: 8)
+        let rdsAuthToken = String(presignedURL.absoluteString[startIndex...])


minor: dsqlToken*

deepakscomk · 2025-01-08T20:22:43Z

Sources/Core/AWSClientRuntime/Sources/AWSClientRuntime/Customizations/AuthTokenGenerator.swift

+        )
+
+        guard let presignedURL = signedRequest?.destination.url else {
+            throw ClientError.authError("Failed to generate auth token for RDS.")


token for DSQL*

deepakscomk · 2025-01-08T20:26:34Z

Sources/Core/AWSClientRuntime/Sources/AWSClientRuntime/Customizations/AuthTokenGenerator.swift

    ///
    /// - Parameters:
    ///   - endpoint: The endpoint of the RDS instance. E.g., `rdsmysql.123456789012.us-west-2.rds.amazonaws.com`
    ///   - port: The port of the RDS instance to connect to. E.g., `3306`
    ///   - region: The region that RDS instance is located in. E.g., `us-west-2`
    ///   - username: The username of the RDS database user. E.g., `admin`
    ///   - expiration: The expiration for the token in seconds. Default is 900 seconds (15 minutes).
-    public func generateAuthToken(
+    public func generateRDSAuthToken(


can you please check if its backward compatible, does it breaks any existing client using it ?

This is the underlying generator hidden from normal import unless user explicitly uses @_spi(AuthTokenGenerator) tag to import it. Users of DSQL and RDS would use the auth token generator exposed via the wrapper in respective service modules, so this function name change isn't visible to them.

Do you mean to say for clients it is impossible to import this function?

This function is part of AWSClientRuntime module, and it's hidden unless users do @_spi(AuthTokenGenerator) import AWSClientRuntime. A normal import import AWSClientRuntime won't expose this function.

Instead of accessing the underlying generator, users can just use the wrapper generators. The respective service modules AWSRDS and AWSDSQL will have a wrapper for this hidden generator, which isn't hidden. You can see this code generation in GitHub diff of this PR. So users can simply do this:

import AWSDSQL let token = AWSDSQL.AuthTokenGenerator(. . .).generateDBConnectAuthToken(. . .)

deepakscomk · 2025-01-08T20:58:37Z

...software/amazon/smithy/aws/swift/codegen/customization/dsql/AuthTokenGeneratorIntegration.kt

+                ///
+                /// - Parameters:
+                ///   - endpoint: The endpoint of the RDS instance. E.g., `peccy.dsql.us-east-1.on.aws`
+                ///   - region: The region that RDS instance is located in. E.g., `us-east-1`


Sichan Yoo added 5 commits January 7, 2025 09:07

Move AuthTokenGenerator to Customizations/ from Customizations/RDS/.

90e098b

Add another method to the underlying auth token generator in AWSClien…

182d1eb

…tRuntime to generate token for DSQL. Update comments to account for both RDS and DSQL.

Add wrapper class codegen for DSQL.

c999c4c

Include generated code for reviewers

62a70ba

Address ktlint

dbc7363

sichanyoo commented Jan 8, 2025

View reviewed changes

dayaffe approved these changes Jan 8, 2025

View reviewed changes

Sichan Yoo added 2 commits January 8, 2025 11:54

Merge branch 'main' into feat/dsql-auth-token-generator

5cb6806

Merge branch 'main' into feat/dsql-auth-token-generator

3a39de1

deepakscomk reviewed Jan 8, 2025

View reviewed changes

Update comments and variable names that refer to RDS instead of DSQL

d3defa4

sichanyoo requested a review from deepakscomk January 8, 2025 21:18

deepakscomk approved these changes Jan 8, 2025

View reviewed changes

sichanyoo merged commit 6de3101 into main Jan 8, 2025
25 checks passed

sichanyoo deleted the feat/dsql-auth-token-generator branch January 8, 2025 21:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Auth token generator for AWS DSQL #1857

feat: Auth token generator for AWS DSQL #1857

sichanyoo commented Jan 7, 2025

sichanyoo left a comment

sichanyoo Jan 8, 2025

sichanyoo Jan 8, 2025

sichanyoo Jan 8, 2025

sichanyoo Jan 8, 2025

sichanyoo Jan 8, 2025

dayaffe Jan 8, 2025

deepakscomk Jan 8, 2025

sichanyoo Jan 8, 2025

deepakscomk Jan 8, 2025

sichanyoo Jan 8, 2025

deepakscomk Jan 8, 2025

sichanyoo Jan 8, 2025

srudeepk Jan 8, 2025

sichanyoo Jan 8, 2025 •

edited

Loading

deepakscomk Jan 8, 2025

sichanyoo Jan 8, 2025

		@@ -0,0 +1,94 @@
		package software.amazon.smithy.aws.swift.codegen.customization.dsql

		@@ -68,7 +68,7 @@ class AuthTokenGeneratorIntegration : SwiftIntegration {
		username: String,

		@@ -52,7 +52,7 @@ public class AuthTokenGenerator {
		username: String,

		@@ -16,7 +16,7 @@ import SmithyIdentity
		import struct Foundation.Date

feat: Auth token generator for AWS DSQL #1857

feat: Auth token generator for AWS DSQL #1857

Conversation

sichanyoo commented Jan 7, 2025

Issue #

Description of changes

New/existing dependencies impact assessment, if applicable

Conventional Commits

sichanyoo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sichanyoo Jan 8, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sichanyoo Jan 8, 2025 •

edited

Loading