Team Edition Documentation

DOWNLOAD pdf

AWS IAM

Table of contents

Overview

Team Edition supports AWS IAM authentication to enhance security for database operations within AWS environments.

For comprehensive setup information of AWS IAM itself, refer to the official AWS IAM documentation.

Configuration steps

For Team Edition
Step 1: Enabling AWS Authentication

  1. As an administrator, go to Settings -> Server Configuration.

  2. Find the AWS option (in the Configuration section) and AWS IAM (in the Authentication Settings section). Activate this setting to enable AWS authentication.

  3. Save the changes.

For instructions on configuring AWS Regions, see AWS Settings.

Step 2: Adding an Identity Provider

  1. As an administrator, navigate to Settings -> Identity Providers.

  2. Click on the + Add button.

  3. Fill in the following fields:

    Field Description
    Provider Select AWS IAM from the dropdown menu.
    ID Enter a unique identifier for the configuration.
    Configuration name Enter a descriptive name for this configuration.
    Description Provide a brief description of this identity provider configuration.
    Icon URL Enter the URL of an icon to represent this provider.
    Disabled Leave unchecked to enable this identity provider.
    Account IDs Enter AWS Account IDs, separated by commas. Only users from these accounts are allowed.
    AWS session lifetime Specify the duration for the AWS session in seconds.

Tip for Account IDs: You can create entries for different Identity Providers for a more flexible configuration.

  1. Click on the Create button.
Step 3: Logging in

  1. With the AWS configuration now established, proceed to the login screen.

  2. You will be presented with two options for key types:

    • For permanent credentials, select Static access keys.
    • If using credentials that change regularly, select Temporary access keys.

  3. Input your Access Key and Secret Key in the respective fields.

    1. If you selected Temporary access keys, enter your Session Token in the additional field that appears.

  4. Confirm your details and click the LOGIN button to authenticate.

Note: To make databases available for users who log in via AWS IAM, the administrator must first add the desired databases. This is done by navigating to Connections -> Cloud Connections and including them in the Database Navigator.

Special characteristics

  • No Server-Side Key Storage: Team Edition is designed not to store AWS access and secret keys on the server, ensuring they are not held in databases or configuration files. This approach is crucial for maintaining the security of your data.

  • Automatic administrator role assignment: The AWS user responsible for configuring Team Edition automatically receives administrator privileges in the Team Edition instance. This user will have comprehensive control over the instance's settings and configurations.

  • AWS account association: Upon completing the server configuration, the AWS account of the administrator is associated with the Team Edition instance. This means that only AWS users belonging to this specific account can authenticate and access this instance of Team Edition.

  • User management within AWS scope: Team Edition for AWS does not support the creation of new users within its platform. It solely operates with existing AWS user accounts. Consequently, every user who needs access must authenticate through their AWS account.

  • Database Authentication Requirements: AWS databases typically have their own authorization mechanisms, requiring additional authentication parameters such as a username and password. For RDS/Aurora databases using IAM authentication, you may only need to provide the database username, leaving the password field empty.

IAM permissions

Team Edition uses the following AWS services in order to operate with databases (most of them are optional):

  • STS (required): used for user authentication
  • RDS: list RDS/Aurora instances for cloud databases explorer (describeDBInstances)
  • Redshift: list Redshift clusters for cloud databases explorer (describeClusters)
  • DynamoDB: all DynamoDB services for DynamoDB operating. Can be read-only for read-only DynamoDB access.
  • DocumentDB: list DocumentDB clusters for cloud databases explorer (describeDBClusters)
  • IAM (optional): additional user/organization information read (like account organization name)

Team Edition uses native database clients to connect and operate with most databases. It uses AWS services only to find database instances and configure database connection.
The only exception is the DynamoDB service which is a database driver by itself. You can limit DynamoDB access directly in the AWS console.