(aws-rds): grantConnect for IAM authentication provides invalid permissions (surface DbiResourceId)

[henripoikonen]

DatabaseInstance has a method grantConnect for granting connect access to instance using IAM based authentication.

However, the db resource ARN in the produced IAM policy is incorrect and doesn't work. Based on the documentation The format for the resource in the IAM policy should be: arn:aws:rds-db:region:account-id:dbuser:DbiResourceId/db-user-name

The actual resource produced by grantConnect is having format: arn:aws:rds:region:account-id:db:DBInstanceId. Also, the function doesn't provide any parameter to define the db username to be used in the policy.

Reproduction Steps

import { Stack, Construct, StackProps } from '@aws-cdk/core';
import {
  DatabaseInstance,
  DatabaseInstanceEngine,
  PostgresEngineVersion,
  Credentials,
} from '@aws-cdk/aws-rds';

import { IVpc } from '@aws-cdk/aws-ec2';
import { User } from '@aws-cdk/aws-iam';

export interface MyStackProps extends StackProps {
  vpc: IVpc;
}
export class MyStack extends Stack {
  constructor(scope: Construct, id: string, props: MyStackProps) {
    super(scope, id, props);

    const db = new DatabaseInstance(this, 'Instance', {
      engine: DatabaseInstanceEngine.postgres({ version: PostgresEngineVersion.VER_12_4 }),
      credentials: Credentials.fromGeneratedSecret('testuser'),
      vpc: props.vpc,
      port: 5432,
      iamAuthentication: true,
    });

    const user = new User(this, 'TestUser', {
      userName: 'testuser',
    });

    db.grantConnect(user);
  }
}

What did you expect to happen?

To create a IAM policy where the resource ARN would be according to the documentation i.e. arn:aws:rds-db:region:account-id:dbuser:DbiResourceId/db-user-name

What actually happened?

Instead of the correct policy, the generated template contains following definition:

           {
              "Action": "rds-db:connect",
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:",
                    {
                      "Ref": "AWS::Partition"
                    },
                    ":rds:",
                    {
                      "Ref": "AWS::Region"
                    },
                    ":",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":db:",
                    {
                      "Ref": "InstanceC1063A87"
                    }
                  ]
                ]
              }
            }

In addition that the format of the ARN is incorrect, also wrong DB identifier is used. The template uses the DB Instance id but the correct identifier is the DB Resource id.

Environment

• CDK CLI Version : 1.75.0
• Framework Version: 1.75.0
• Node.js Version: 12.18.3
• OS : OSx
• Language (Version): Typescript 4.1.2

Other

The support for the grantConnect was requested in this issue and added in this PR.

A comment in the original issue still stands i.e. that the DB Resource Id is not accessible in Cloudformation.

---

This is 🐛 Bug Report

[skinny85]

Thanks for reporting @henripoikonen .

[henripoikonen]

Thanks for reporting @henripoikonen .

No problem! I would assume that this enhancement would need to be first implemented to Clouformation before a proper fix can be made?

[skinny85]

Thanks for reporting @henripoikonen .

No problem! I would assume that this enhancement would need to be first implemented to Clouformation before a proper fix can be made?

Yep, I think so - I don't see how we could construct the correct database instance resource ID without it.

[jdvornek]

Seems like a similar issue exists for DatabaseProxy. Do you want a separate issue for that or is it easier to track it all here?

I was able to work around the invalid permissions in the current grantConnect() for DatabaseProxy with the following. Thought I'd leave it here in case it might be helpful to someone else.

function fixedGrantConnect(rds_proxy, grantee, db_user) {
  let parsed_arn = Arn.parse(rds_proxy.dbProxyArn);
  parsed_arn.service = 'rds-db';
  parsed_arn.resource =
    Fn.join(':',
            [
              'dbuser',
              Fn.select(6, Fn.split(':', rds_proxy.dbProxyArn))
            ]);
  parsed_arn.resourceName = db_user;
  return Grant.addToPrincipal({
                                grantee,
                                actions:      ['rds-db:connect'],
                                resourceArns: [Arn.format(parsed_arn, Stack.of(rds_proxy))]
                              });
}

[skinny85]

@jdvornek is this a problem with the code we have from #12243 ?

[jdvornek]

@skinny85 that's right. In grantConnect the Grant resource is created referencing the proxy ARN, but I believe it should be something like arn:aws:rds-db:us-east-2:1234567890:dbuser:prx-ABCDEFGHIJKL01234/db_user per the documentation.

[skinny85]

Damn. Any chance of a PR fixing this, using the code from your workaround? 🙂 https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md

[jdvornek]

@skinny85 #12416 is in for the DatabaseProxy fix. To keep things separate I opened a new issue for that as the solution has no bearing on grantConnect for DatabaseInstance or DatabaseCluster.

[skinny85]

@jdvornek thanks, that's awesome!

[underbluewaters]

I'm not using the database proxy, but having problems granting permissions to directly access an RDS instance.

This:

    const role = new iam.Role(this, "MaintenanceRole", {
      assumedBy: new ServicePrincipal("ecs-tasks.amazonaws.com"),
    });
    asset.repository.grantPull(role);
    props.db.grantConnect(role);

    const taskDefinition = new ecs.FargateTaskDefinition(
      this,
      "SeaSketchMaintenanceFargateTaskDef",
      {
        cpu: 256,
        executionRole: role,
        memoryLimitMiB: 512,
      }
    );

Yields something like this, which appears useless:

    {
        "Effect": "Allow",
        "Action": [
            "rds-db:connect",
        ],
        "Resource": [
            "arn:aws:rds:us-west-2:123430260133:db:si1b6m5gggg9ypx"
        ]
    },

[skinny85]

Yes @underbluewaters . The problem is that we're lacking a feature in CloudFormation to get the Database instance resource ID, which is needed to correctly create this policy, as has been said in #11851 (comment).

[Plasma]

Just hit this issue myself, looking forward to a fix, thank you!

[mjgp2]

Is it possible for the CDK team to raise this with the CF team? I mean this is really broken.

[jdvornek]

I believe the ResourceID is available from the cli, which should mean that you can use a custom resource to get the required fields to generate the policy.

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html

[jdvornek]

This works for an Aurora cluster, I believe. Obviously it needs to be extended for instances, etc, but maybe this will get someone unblocked and it seems easy enough to swap out once a proper fix is available.

const someCluster = new rds.DatabaseCluster();
const someDatabaseUser = 'test';
const someRole = new iam.Role();
const dbResourceId = new custom.AwsCustomResource(this, 'MembershipDBResourceID', {
  onCreate: {
    service: 'RDS',
    action: 'describeDBClusters',
    parameters: {
      DBClusterIdentifier: someCluster.clusterIdentifier
    },
    physicalResourceId: custom.PhysicalResourceId.fromResponse('DBClusters.0.DbClusterResourceId')
  },
  policy: custom.AwsCustomResourcePolicy.fromSdkCalls({
    resources: custom.AwsCustomResourcePolicy.ANY_RESOURCE
  })
});
const scopeStack = cdk.Stack.of(this);
const resourceId = dbResourceId.getResponseField('DBClusters.0.DbClusterResourceId');
const userArn = scopeStack.formatArn({
                                       service: 'rds-db',
                                       resource: 'dbuser',
                                       resourceName: `${resourceId}/${someDatabaseUser}`,
                                       sep: ':',
                                     });
iam.Grant.addToPrincipal({
  grantee: someRole,
  actions: ["rds-db:connect"],
  resourceArns: [userArn]
});

That yields

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "rds-db:connect",
            "Resource": "arn:aws:rds-db:<region>:<account>:dbuser:cluster-0123456789/test",
            "Effect": "Allow"
        }
    ]
}

[alex9311]

thanks for the workarounds @jdvornek and @cloventt, lifesavers. Confirmed these work for postgres db instances.

function grantIamAuth(
  scope: cdk.Stack,
  db: rds.DatabaseInstance,
  grantPrincipal: iam.IPrincipal
) {
  const context = cdke._98point6Stack.getContext(scope)

  // https://github.com/aws/aws-cdk/issues/11851
  const dbResourceId = new custom.AwsCustomResource(
    scope,
    `PostgresDBResourceIdCR-${grantPrincipal}`,
    {
      onCreate: {
        service: 'RDS',
        action: 'describeDBInstances',
        parameters: {
          DBInstanceIdentifier: db.instanceIdentifier,
        },
        physicalResourceId: custom.PhysicalResourceId.fromResponse(
          'DBInstances.0.DbiResourceId'
        ),
        outputPath: 'DBInstances.0.DbiResourceId',
      },
      policy: custom.AwsCustomResourcePolicy.fromSdkCalls({
        resources: custom.AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    }
  )
  const resourceId = dbResourceId.getResponseField(
    'DBInstances.0.DbiResourceId'
  )

  const dbUserArn = `arn:aws:rds-db:${my_region}:${my_account_num}:dbuser:${resourceId}/${my_iam_user}`
  iam.Grant.addToPrincipal({
    grantee: grantPrincipal,
    actions: ['rds-db:connect'],
    resourceArns: [dbUserArn],
  })
}

[cloventt]

We were bitten by a hidden issue when updating CDK. Because we had not specified an onUpdate handler, we received an error that the DbiResourceId did not exist:

CustomResource attribute error: Vendor response doesn't contain DBInstances.0.DbiResourceId key in object

To fix this we duplicated the code to add an onUpdate handler:

    new customresource.AwsCustomResource(this, 'RdsInstanceResourceId', {
      onCreate: {
        service: 'RDS',
        action: 'describeDBInstances',
        parameters: {
          DBInstanceIdentifier: this.rdsInstance.instanceIdentifier,
        },
        physicalResourceId: customresource.PhysicalResourceId.fromResponse('DBInstances.0.DbiResourceId'),
        outputPath: 'DBInstances.0.DbiResourceId',
      },
      onUpdate: {
        service: 'RDS',
        action: 'describeDBInstances',
        parameters: {
          DBInstanceIdentifier: this.rdsInstance.instanceIdentifier,
        },
        physicalResourceId: customresource.PhysicalResourceId.fromResponse('DBInstances.0.DbiResourceId'),
        outputPath: 'DBInstances.0.DbiResourceId',
      },
      policy: customresource.AwsCustomResourcePolicy.fromSdkCalls({
        resources: customresource.AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });

[rittneje]

@cloventt The docs for AwsCustomResource say that onCreate will call onUpdate by default. So probably you only need to specify onUpdate. https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_custom-resources.AwsCustomResourceProps.html#oncreate

[skinny85]

Would someone be interested in contributing their Custom Resource that does this back to the CDK Construct Library for RDS?

[alex9311]

@skinny85 I would be interested. Is there a good example I can use to follow? Maybe #12416 ?

[skinny85]

@alex9311 yes, #12416 should be helpful, as well as the code in this comment of this issue: #11851 (comment).

[mkhraisha]

is this fixed by #12416?

if so can we update the docs to reflect that the grantConnect now functions correctly?

[skinny85]

is this fixed by #12416?

if so can we update the docs to reflect that the grantConnect now functions correctly?

No. #12416 is about grantConnect() in the Proxy resource, while this issue is about grantConnect() in the DatabaseInstance resource.

[sander-su]

As aws-cloudformation/cloudformation-coverage-roadmap#105 has been released some days ago does this means we can expect a fix soon? @skinny85

[ryanchamp-ICE]

So it looks like skinny85 doesn't work for Amazon any more, who would be the person to give an update on this particular issue?

[drankard]

Is this still stalling ?

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[mkhraisha]

I see this is closed has it been fixed?
if so should update the docs here: grantConnect