Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[v14] use rds proxy port instead of proxy target port #35389

Merged
merged 2 commits into from Dec 6, 2023
Merged

[v14] use rds proxy port instead of proxy target port #35389

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
085befc
use rds proxy port instead of proxy target port
GavinFrazar Dec 5, 2023
2b3f12b
remove unused func and IAM permissions
GavinFrazar Dec 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 0 additions & 2 deletions docs/pages/database-access/reference/aws.mdx
View file
Open in desktop
Expand Up @@ -180,7 +180,6 @@ permissions if IAM authentication is already enabled.
"Action": [
"rds:DescribeDBProxies",
"rds:DescribeDBProxyEndpoints",
"rds:DescribeDBProxyTargets",
"rds:ListTagsForResource",
],
"Resource": "*"
Expand Down Expand Up @@ -213,7 +212,6 @@ permissions if IAM authentication is already enabled.
"Action": [
"rds:DescribeDBProxies",
"rds:DescribeDBProxyEndpoints",
"rds:DescribeDBProxyTargets",
"rds:ListTagsForResource",
],
"Resource": "*"
Expand Down
20 changes: 5 additions & 15 deletions lib/cloud/mocks/aws_rds.go
View file
Open in desktop
Expand Up @@ -33,12 +33,11 @@ import (
// RDSMock mocks AWS RDS API.
type RDSMock struct {
rdsiface.RDSAPI
DBInstances []*rds.DBInstance
DBClusters []*rds.DBCluster
DBProxies []*rds.DBProxy
DBProxyEndpoints []*rds.DBProxyEndpoint
DBEngineVersions []*rds.DBEngineVersion
DBProxyTargetPort int64
DBInstances []*rds.DBInstance
DBClusters []*rds.DBCluster
DBProxies []*rds.DBProxy
DBProxyEndpoints []*rds.DBProxyEndpoint
DBEngineVersions []*rds.DBEngineVersion
}

func (m *RDSMock) DescribeDBInstancesWithContext(ctx aws.Context, input *rds.DescribeDBInstancesInput, options ...request.Option) (*rds.DescribeDBInstancesOutput, error) {
Expand Down Expand Up @@ -189,15 +188,6 @@ func (m *RDSMock) DescribeDBProxyEndpointsWithContext(ctx aws.Context, input *rd
return &rds.DescribeDBProxyEndpointsOutput{DBProxyEndpoints: endpoints}, nil
}

func (m *RDSMock) DescribeDBProxyTargetsWithContext(ctx aws.Context, input *rds.DescribeDBProxyTargetsInput, options ...request.Option) (*rds.DescribeDBProxyTargetsOutput, error) {
// only mocking to return a port here
return &rds.DescribeDBProxyTargetsOutput{
Targets: []*rds.DBProxyTarget{{
Port: aws.Int64(m.DBProxyTargetPort),
}},
}, nil
}

func (m *RDSMock) DescribeDBProxiesPagesWithContext(ctx aws.Context, input *rds.DescribeDBProxiesInput, fn func(*rds.DescribeDBProxiesOutput, bool) bool, options ...request.Option) error {
fn(&rds.DescribeDBProxiesOutput{
DBProxies: m.DBProxies,
Expand Down
1 change: 0 additions & 1 deletion lib/configurators/aws/aws.go
View file
Open in desktop
Expand Up @@ -188,7 +188,6 @@ var (
discovery: []string{
"rds:DescribeDBProxies",
"rds:DescribeDBProxyEndpoints",
"rds:DescribeDBProxyTargets",
"rds:ListTagsForResource",
},
metadata: []string{
Expand Down
18 changes: 9 additions & 9 deletions lib/configurators/aws/aws_test.go
View file
Open in desktop
Expand Up @@ -617,15 +617,15 @@ func TestAWSIAMDocuments(t *testing.T) {
},
statements: []*awslib.Statement{
{Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource",
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource",
}},
{Effect: awslib.EffectAllow, Resources: []string{userTarget.String()}, Actions: []string{
"iam:GetUserPolicy", "iam:PutUserPolicy", "iam:DeleteUserPolicy",
}},
},
boundaryStatements: []*awslib.Statement{
{Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource",
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource",
"rds-db:connect",
}},
{Effect: awslib.EffectAllow, Resources: []string{userTarget.String()}, Actions: []string{
Expand All @@ -649,15 +649,15 @@ func TestAWSIAMDocuments(t *testing.T) {
},
statements: []*awslib.Statement{
{Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource",
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource",
}},
{Effect: awslib.EffectAllow, Resources: []string{userTarget.String()}, Actions: []string{
"iam:GetUserPolicy", "iam:PutUserPolicy", "iam:DeleteUserPolicy",
}},
},
boundaryStatements: []*awslib.Statement{
{Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource",
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource",
"rds-db:connect",
}},
{Effect: awslib.EffectAllow, Resources: []string{userTarget.String()}, Actions: []string{
Expand Down Expand Up @@ -852,15 +852,15 @@ func TestAWSIAMDocuments(t *testing.T) {
},
statements: []*awslib.Statement{
{Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource",
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource",
}},
{Effect: awslib.EffectAllow, Resources: []string{roleTarget.String()}, Actions: []string{
"iam:GetRolePolicy", "iam:PutRolePolicy", "iam:DeleteRolePolicy",
}},
},
boundaryStatements: []*awslib.Statement{
{Effect: awslib.EffectAllow, Resources: []string{"*"}, Actions: []string{
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource",
"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource",
"rds-db:connect",
}},
{Effect: awslib.EffectAllow, Resources: []string{roleTarget.String()}, Actions: []string{
Expand Down Expand Up @@ -973,7 +973,7 @@ func TestAWSIAMDocuments(t *testing.T) {
{
Effect: awslib.EffectAllow,
Resources: awslib.SliceOrString{"*"},
Actions: awslib.SliceOrString{"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource"},
Actions: awslib.SliceOrString{"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource"},
},
},
wantInlineAsBoundary: true,
Expand Down Expand Up @@ -1088,7 +1088,7 @@ func TestAWSIAMDocuments(t *testing.T) {
{
Effect: awslib.EffectAllow,
Resources: awslib.SliceOrString{"*"},
Actions: awslib.SliceOrString{"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource"},
Actions: awslib.SliceOrString{"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource"},
},
{
Effect: awslib.EffectAllow,
Expand All @@ -1110,7 +1110,7 @@ func TestAWSIAMDocuments(t *testing.T) {
{
Effect: awslib.EffectAllow,
Resources: awslib.SliceOrString{"*"},
Actions: awslib.SliceOrString{"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:DescribeDBProxyTargets", "rds:ListTagsForResource"},
Actions: awslib.SliceOrString{"rds:DescribeDBProxies", "rds:DescribeDBProxyEndpoints", "rds:ListTagsForResource"},
},
{
Effect: awslib.EffectAllow,
Expand Down
29 changes: 19 additions & 10 deletions lib/services/database.go
View file
Open in desktop
Expand Up @@ -938,12 +938,12 @@ func NewDatabasesFromRDSCluster(cluster *rds.DBCluster) (types.Databases, error)
}

// NewDatabaseFromRDSProxy creates database resource from RDS Proxy.
func NewDatabaseFromRDSProxy(dbProxy *rds.DBProxy, port int64, tags []*rds.Tag) (types.Database, error) {
func NewDatabaseFromRDSProxy(dbProxy *rds.DBProxy, tags []*rds.Tag) (types.Database, error) {
metadata, err := MetadataFromRDSProxy(dbProxy)
if err != nil {
return nil, trace.Wrap(err)
}
protocol, err := rdsEngineFamilyToProtocol(aws.StringValue(dbProxy.EngineFamily))
protocol, port, err := rdsEngineFamilyToProtocolAndPort(aws.StringValue(dbProxy.EngineFamily))
if err != nil {
return nil, trace.Wrap(err)
}
Expand All @@ -961,12 +961,12 @@ func NewDatabaseFromRDSProxy(dbProxy *rds.DBProxy, port int64, tags []*rds.Tag)

// NewDatabaseFromRDSProxyCustomEndpoint creates database resource from RDS
// Proxy custom endpoint.
func NewDatabaseFromRDSProxyCustomEndpoint(dbProxy *rds.DBProxy, customEndpoint *rds.DBProxyEndpoint, port int64, tags []*rds.Tag) (types.Database, error) {
func NewDatabaseFromRDSProxyCustomEndpoint(dbProxy *rds.DBProxy, customEndpoint *rds.DBProxyEndpoint, tags []*rds.Tag) (types.Database, error) {
metadata, err := MetadataFromRDSProxyCustomEndpoint(dbProxy, customEndpoint)
if err != nil {
return nil, trace.Wrap(err)
}
protocol, err := rdsEngineFamilyToProtocol(aws.StringValue(dbProxy.EngineFamily))
protocol, port, err := rdsEngineFamilyToProtocolAndPort(aws.StringValue(dbProxy.EngineFamily))
if err != nil {
return nil, trace.Wrap(err)
}
Expand Down Expand Up @@ -1521,17 +1521,17 @@ func rdsEngineToProtocol(engine string) (string, error) {
return "", trace.BadParameter("unknown RDS engine type %q", engine)
}

// rdsEngineFamilyToProtocol converts RDS engine family to the database protocol.
func rdsEngineFamilyToProtocol(engineFamily string) (string, error) {
// rdsEngineFamilyToProtocolAndPort converts RDS engine family to the database protocol and port.
func rdsEngineFamilyToProtocolAndPort(engineFamily string) (string, int, error) {
switch engineFamily {
case rds.EngineFamilyMysql:
return defaults.ProtocolMySQL, nil
return defaults.ProtocolMySQL, RDSProxyMySQLPort, nil
case rds.EngineFamilyPostgresql:
return defaults.ProtocolPostgres, nil
return defaults.ProtocolPostgres, RDSProxyPostgresPort, nil
case rds.EngineFamilySqlserver:
return defaults.ProtocolSQLServer, nil
return defaults.ProtocolSQLServer, RDSProxySQLServerPort, nil
}
return "", trace.BadParameter("unknown RDS engine family type %q", engineFamily)
return "", 0, trace.BadParameter("unknown RDS engine family type %q", engineFamily)
}

// labelsFromAzureServer creates database labels for the provided Azure DB server.
Expand Down Expand Up @@ -2038,6 +2038,15 @@ const (
RDSEngineModeMultiMaster = "multimaster"
)

const (
// RDSProxyMySQLPort is the port that RDS Proxy listens on for MySQL connections.
RDSProxyMySQLPort = 3306
// RDSProxyPostgresPort is the port that RDS Proxy listens on for Postgres connections.
RDSProxyPostgresPort = 5432
// RDSProxySQLServerPort is the port that RDS Proxy listens on for SQL Server connections.
RDSProxySQLServerPort = 1433
)

const (
// AzureEngineMySQL is the Azure engine name for MySQL single-server instances.
AzureEngineMySQL = "Microsoft.DBforMySQL/servers"
Expand Down