ruby/rails: Adapter supports non-admin users, readme refresh by trstephen-amazon · Pull Request #114 · aws-samples/aurora-dsql-samples

trstephen-amazon · 2025-05-03T00:18:07Z

Changes

Update the adapter to work with non-Admin users. Allows the user to be set with a CLUSTER_USER env var (defaults to 'admin') and will generate an appropriately scoped auth token for the cluster.
Rework the readme into:
- ./README.md: Explains how to use the pg-aws_rds_iam plugin to generate DSQL tokens and necessary dialect updates. Intended audience is someone who has an existing Rails app and wants to know the necessary changes for DSQL.
- ./petclinic/README.md: How to install the sample Rails app and work with the data model.
Select the schema based on CLUSTER_USER

Testing

Used the rails console with my cluster with default (admin) and a non-admin user. Connect and data retrieval OK in both cases:

❯ bin/rails console
Loading development environment (Rails 7.2.2.1)
petclinic(dev)> Owner.all
  Owner Load (1992.5ms)  SELECT "owners".* FROM "owners" /* loading for pp */ LIMIT 11
=> []

For user-based schema selection I 1/ loaded data as non-Admin

❯ bin/rails console
Loading development environment (Rails 7.2.2.1)
petclinic(dev)> Vet.all
  Vet Load (2429.5ms)  SELECT "vets".* FROM "vets" /* loading for pp */ LIMIT 11
=> []
petclinic(dev)> Vet.new(name: "NonAdmin").save
  TRANSACTION (157.3ms)  BEGIN
  Vet Create (258.9ms)  INSERT INTO "vets" ("name", "owner_id", "created_at", "updated_at") VALUES ('NonAdmin', NULL, '2025-05-06 21:37:26.748901', '2025-05-06 21:37:26.748901') RETURNING "id"
  TRANSACTION (130.8ms)  COMMIT
=> true
petclinic(dev)> Vet.all
  Vet Load (106.7ms)  SELECT "vets".* FROM "vets" /* loading for pp */ LIMIT 11
=>
[#<Vet:0x000000012559b688
  id: "d07bf384-c10d-4a84-bafc-f356e1f18432",
  name: "NonAdmin",
  owner_id: nil,
  created_at: "2025-05-06 21:37:26.748901000 +0000",
  updated_at: "2025-05-06 21:37:26.748901000 +0000">]

2/ Switched CLUSTER_USER=admin, loaded more data

petclinic(dev)> Vet.new(name: "Admin").save
  TRANSACTION (96.3ms)  BEGIN
  Vet Create (189.4ms)  INSERT INTO "vets" ("name", "owner_id", "created_at", "updated_at") VALUES ('Admin', NULL, '2025-05-06 21:40:24.084691', '2025-05-06 21:40:24.084691') RETURNING "id"
  TRANSACTION (130.9ms)  COMMIT
=> true

3/ As admin, only the 'Admin' vet is visible

petclinic(dev)> Vet.all
  Vet Load (97.5ms)  SELECT "vets".* FROM "vets" /* loading for pp */ LIMIT 11
=>
[#<Vet:0x000000012303c450
  id: "624e0c82-1454-424d-b021-bde8c2cd8bf6",
  name: "Admin",
  owner_id: nil,
  created_at: "2025-05-06 21:40:24.084691000 +0000",
  updated_at: "2025-05-06 21:40:24.084691000 +0000">]

By submitting this pull request, I confirm that my contribution is made under
the terms of the MIT-0 license.

Thank you for your contribution!

- Update the adapter to work with non-Admin users. Allows the user to be set with a CLUSTER_USER env var (defaults to 'admin') and will generate an appropriately scoped auth token for the cluster. - Rework the readme into: - ./README.md: Explains how to use the pg-aws_rds_iam plugin to generate DSQL tokens and necessary dialect updates. Intended audience is someone who has an existing Rails app and wants to know the necessary changes for DSQL. - ./petclinic/README.md: How to install the sample Rails app and work with the data model.

imforster · 2025-05-05T21:03:37Z

+and for long-lived applications should use one that will refresh automatically: `Aws::AssumeRoleCredentials` or
+`Aws::InstanceProfileCredentials` to name a few. The retrieved credentials will need permission to `dsql:DbConnectAdmin`
+if using the `admin` role or `dsql:DbConnect` if using a custom role. See Aurora DSQL documentation for
+[IAM role connect][docs-dsql-iam] and [authentication token generation][docs-generate-token] for more details.


Remove if you accept my suggestion

imforster · 2025-05-05T21:04:49Z

-        :region => region
-    })
-
+    # e.g. host == "<clusterID>.dsql.us-east-1.on.aws"


Suggested change

# e.g. host == "<clusterID>.dsql.us-east-1.on.aws"

# e.g. host == "<clusterID>.dsql.<region>.on.aws"

Disagree here, keeping an actual region in place so it's obvious what the regex is matching against.

trstephen-amazon · 2025-05-05T21:42:16Z

I agree with a lot of @imforster 's comments. Will address them in an upcoming commit. I don't want to merge this until I've had a chance to investigate schema selection based on user. It's a standard feature with our other examples.

…samples into trs/ror

trstephen-amazon · 2025-05-06T22:28:17Z

Ready for review! Updated the OP to include the user-based schema selection POC

Co-authored-by: Marcos Lopez <lmarcosi@amazon.com>

trstephen-amazon requested review from srudeepk and wcmjunior and removed request for srudeepk May 3, 2025 00:18