Documentation
¶
Overview ¶
Package awscreds resolves database credentials on AWS: Secrets Manager for stored credentials, RDS IAM for short-lived tokens.
It is the AWS implementation of dbconn.CredentialSource. A provider added later supplies its own, and nothing above this line changes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RegionFromARN ¶
RegionFromARN extracts the region from an ARN (arn:aws:secretsmanager:<region>:<account>:secret:<name>).
Types ¶
type Secret ¶
type Secret struct {
Username string `json:"username"`
Password string `json:"password"`
Host string `json:"host"`
Port json.Number `json:"port"`
DBName string `json:"dbname"`
}
Secret is the credential JSON in a Secrets Manager secret.
RDS-managed secrets carry the full connection detail, where the secrets Celerity generates carry username and password only. Connection detail is parsed but treated as a fallback, because an endpoint derived from deployed state points at the proxy while the secret names the database behind it.
func FetchSecret ¶
FetchSecret reads and parses a Secrets Manager secret, including the connection detail an RDS-managed secret carries.
The region comes from the ARN so this works from a machine whose default region is somewhere else, which is the normal case for an operator with several environments.
Source Files