postgres/awspostgres: Allow using IAM DB authentication

[reegnz]

Is your feature request related to a problem? Please describe.

I am want to use AWS IAM authentication with my RDS databases:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html

It would be great if awspostgres would support that way of connecting out of the box.

Describe the solution you'd like

When not providing a password, try to build an auth token with the AWS SDK default configuration.
If that succeeds, use that as the password.

Describe alternatives you've considered

I've considered developing a postgres proxy that I can run on localhost that can do that for me, but that's a pretty big effort.

[vangent]

Are you sure it doesn't work? Have you tried connecting using a URL like the one described here:
https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Connecting.Go.html
?

For the most part Go CDK just passes through the URL:
https://github.com/google/go-cloud/blob/master/postgres/awspostgres/awspostgres.go#L72

If it doesn't work, happy to accept a PR.

[reegnz]

The point of my issue would be that the logic to get the IAM token is with go-cloud and not the user of go-cloud. :)
That way I can just say the RDS hostname and username, and the awspostgres driver would figure out the rest (eg. use the SDK to connect to AWS and fetch an RDS IAM Token for a password).

I would be glad to open a PR for this!

[vangent]

I am not sure this is something we want to add. There are so many ways to authenticate to the various Cloud providers, we want to be able to work with the results (e.g., pass through the URL), but I don't think we want to add code to support them all explicitly.

[dmunch]

go-cloud wouldn't need to support all the different ways to get those cloud-specific authentication tokens - However, it could provide a mechanism to plug these, i.e. by the means of a periodic password provider.

I'm mostly working in a .NET environment, and both the PostgreSQL and MySQL providers provide such a mechanism:

• MySQL
• PostgreSQL

I've successfully used this approach using both libraries as well as in Azure as in AWS.

Hard-coded passwords for database authentication really should die out soon, and having library support for this in all languages is crucial for it.

Edit: Further research also shows that this is a thing with other db drivers in the go world:

• Possible to periodically update passwords? jackc/pgx#676