AwsRdsIamDatabasePasswordProvider 2.7.0

Bundle
org.apache.nifi | nifi-aws-nar
Description
Generates Amazon RDS IAM authentication tokens each time a JDBC connection is requested. The generated token replaces the database user password so that NiFi does not need to store long-lived credentials inside DBCP services.
Tags
aws, iam, jdbc, password, rds
Input Requirement
Supports Sensitive Dynamic Properties
false
  • Additional Details for AwsRdsIamDatabasePasswordProvider 2.7.0

    Summary

    AwsRdsIamDatabasePasswordProvider generates Amazon RDS IAM authentication tokens each time a JDBC connection is requested. The Controller Service implements the NiFi DatabasePasswordProvider API, so it can be referenced from DBCP controller services to avoid storing long-lived database passwords in NiFi.

    Usage

    1. Configure an AWSCredentialsProviderControllerService so the password provider can obtain AWS credentials (for example, using an IAM role or AssumeRoleWithWebIdentity).
    2. Create an AwsRdsIamDatabasePasswordProvider and reference the credentials provider service. Configure the AWS region. Host, port, and database user are inherited from the JDBC URL and “Database User” properties on the referencing DBCP service.
    3. Update the DBCP controller service to set the Database Password Provider property to the new IAM provider. The static Password property is ignored when a provider is configured.
    4. Ensure your JDBC URL enables TLS and includes the SSL parameters recommended by AWS (for example, ssl=true&sslmode=verify-full for PostgreSQL).

    Each time the DBCP service needs to create a physical JDBC connection, a fresh IAM token is generated and supplied as the password. Existing pooled connections remain valid until the database closes them, so standard NiFi pooling properties such as “Maximum Connection Lifetime” still apply.

    Example Setup

    PostgreSQL role and privileges

    Connect to the nifi database as a superuser and run:

    CREATE ROLE nifi_app LOGIN PASSWORD 'temporary';
GRANT rds_iam TO nifi_app;

GRANT CONNECT ON DATABASE nifi TO nifi_app;
GRANT USAGE ON SCHEMA public TO nifi_app;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO nifi_app;
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO nifi_app;

ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT ALL PRIVILEGES ON TABLES TO nifi_app;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT ALL PRIVILEGES ON SEQUENCES TO nifi_app;

    IAM permissions

    Attach a policy like the following to your IAM role (for example myAuroraPostgresRole). Replace <region>, <account-id>, and <db-resource-id> with your values:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "rds-db:connect",
      "Resource": "arn:aws:rds-db:<region>:<account-id>:dbuser:<db-resource-id>/nifi_app"
    }
  ]
}

    Ensure the role’s trust policy allows the NiFi host (EC2, EKS, etc.) to assume it.

    CLI verification

    Generate an IAM auth token and connect with psql:

    TOKEN=$(aws rds generate-db-auth-token \
  --hostname database-1-instance-1.ccfuwyso6lcz.us-east-1.rds.amazonaws.com \
  --port 5432 \
  --region us-east-1 \
  --username nifi_app)

PGPASSWORD="$TOKEN" psql \
  "host=database-1-instance-1.ccfuwyso6lcz.us-east-1.rds.amazonaws.com \
   port=5432 user=nifi_app dbname=nifi \
   sslmode=verify-full sslrootcert=/path/to/rds-combined-ca-bundle.pem"

    When that works, configure NiFi’s DBCP service with:

    • Database Connection URL: jdbc:postgresql://database-1-instance-1.ccfuwyso6lcz.us-east-1.rds.amazonaws.com:5432/nifi?ssl=true&sslmode=verify-full
    • Database User: nifi_app
    • Database Password Provider: AwsRdsIamDatabasePasswordProvider

    NiFi will then mint IAM tokens automatically for each new JDBC connection.

Properties
  • AWS Credentials Provider Service
    Controller Service that provides the AWS credentials used to sign IAM authentication requests.
    Display Name
    AWS Credentials Provider Service
    Description
    Controller Service that provides the AWS credentials used to sign IAM authentication requests.
    API Name
    AWS Credentials Provider Service
    Service Interface
    org.apache.nifi.processors.aws.credentials.provider.AwsCredentialsProviderService
    Service Implementations
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Custom Region
    Custom region, e.g. a region of an AWS compatible service provider
    Display Name
    Custom Region
    Description
    Custom region, e.g. a region of an AWS compatible service provider
    API Name
    Custom Region
    Expression Language Scope
    Environment variables defined at JVM level and system properties
    Sensitive
    false
    Required
    true
    Dependencies
    • Region is set to any of [use-custom-region]
  • Region
    AWS Region in which the service is located
    Display Name
    Region
    Description
    AWS Region in which the service is located
    API Name
    Region
    Default Value
    us-west-2
    Allowable Values
    • AWS GovCloud (US-East)
    • AWS GovCloud (US-West)
    • Africa (Cape Town)
    • Asia Pacific (Hong Kong)
    • Asia Pacific (Hyderabad)
    • Asia Pacific (Jakarta)
    • Asia Pacific (Malaysia)
    • Asia Pacific (Melbourne)
    • Asia Pacific (Mumbai)
    • Asia Pacific (New Zealand)
    • Asia Pacific (Osaka)
    • Asia Pacific (Seoul)
    • Asia Pacific (Singapore)
    • Asia Pacific (Sydney)
    • Asia Pacific (Taipei)
    • Asia Pacific (Thailand)
    • Asia Pacific (Tokyo)
    • Canada (Central)
    • Canada West (Calgary)
    • China (Beijing)
    • China (Ningxia)
    • EU (Germany)
    • EU ISOE West
    • Europe (Frankfurt)
    • Europe (Ireland)
    • Europe (London)
    • Europe (Milan)
    • Europe (Paris)
    • Europe (Spain)
    • Europe (Stockholm)
    • Europe (Zurich)
    • Israel (Tel Aviv)
    • Mexico (Central)
    • Middle East (Bahrain)
    • Middle East (UAE)
    • South America (Sao Paulo)
    • US East (N. Virginia)
    • US East (Ohio)
    • US ISO East
    • US ISO WEST
    • US ISOB East (Ohio)
    • US ISOB West
    • US ISOF EAST
    • US ISOF SOUTH
    • US West (N. California)
    • US West (Oregon)
    • aws global region
    • aws-cn global region
    • aws-iso global region
    • aws-iso-b global region
    • aws-iso-e global region
    • aws-iso-f global region
    • aws-us-gov global region
    • Use Custom Region
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true