Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added info about other cloud providers and token for #4893

Merged
merged 6 commits into from
Oct 17, 2023
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ When deploying in your cloud account, you need to set up your cloud service prov
BigAnimal's cloud account offers a seamless deployment option if you don't want to set up a separate cloud account for your clusters. You can deploy a cluster in BigAnimal's cloud account instantly.

!!! Note Note
Currently, when you deploy in BigAnimal's cloud account, you can use AWS or Google Cloud as your cloud provider.
Currently, when you deploy in BigAnimal's cloud account, you can use AWS or Google Cloud as your cloud provider. If you want to use your cloud account's Identity and Access Management (IAM) service for database authentication, you must deploy clusters in your own cloud account. If you deploy using BigAnimal's cloud account, the underlying cloud provider is hidden, so you can't manage IAM access.
!!!


Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ If you use a single database to host multiple schemas, create a database owner a
```
## IAM authentication for Postgres

Any AWS user with an AWS account connected to a BigAnimal subscription who has the Postgres role of iam_aws can authenticate to the database using their AWS IAM credentials.
Any user with a supported cloud account connected to a BigAnimal subscription who has the Postgres IAM role iam_aws, iam_azure, or iam_gcp can authenticate to the database using their IAM credentials.

### Configuring IAM for Postgres

Expand All @@ -109,32 +109,37 @@ Provision your cluster before configuring IAM for Postgres.
1. Select **Create Cluster** or **Save**.
!!!note
To turn on IAM authentication using the CLI, see [Using IAM authentication on AWS](/biganimal/latest/reference/cli/using_features/#iam-authentication-cli-commands).
1. In AWS, get the ARN of each IAM user requiring database access. In the AWS account connected to BigAnimal, use AWS Identity and Access Management (IAM) to perform user management. See the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_manage.html).
1. From your cloud provider, get the user name of each IAM user requiring database access. In the cloud account connected to BigAnimal, use Identity and Access Management (IAM) to perform user management.

1. In Postgres, if the IAM role doesn’t exist yet, run this Postgres command:
1. In Postgres, if the IAM role doesn’t exist yet, use the `CREATE ROLE` command. For example, for AWS, use:

```
CREATE ROLE "iam_aws";
```

1. For each IAM user, run this Postgres command:
1. For each IAM user, run the `CREATE USER` Postgres command. For example, for AWS, use:

```
CREATE USER "<ARN>" IN ROLE iam_aws;
```

Where <ARN> is the Amazon resource name. (For Azure, use the user principal name. For GCP, use the email address.)
ebgitelman marked this conversation as resolved.
Show resolved Hide resolved

### Logging in to Postgres using IAM credentials

If IAM integration is configured for your cluster, you can log in to Postgres using your AWS Amazon Resource Name (ARN) and access key. Using this ARN + access key combination allows you to connect to your Postgres database using your AWS IAM standard credentials.
If IAM integration is configured for your cluster, you can log in to Postgres using your cloud credentials. Alternatively, you can use your token instead of your password. Logging in either way allows you to connect to your Postgres database using your cloud account's IAM standard credentials.

For either method, you must first authenticate to your cloud service provider IAM to get your password or token.

!!! Note
You can continue to log in using your Postgres username and password. However, doing so doesn’t provide IAM authentication even if this feature is configured.

1. Using your AWS CLI or Cloud shell, obtain your ARN and access key. For guidance on obtaining your ARN and access key, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
1. Get your credentials for your IAM-managed cloud account.
- For AWS, your password is your access key (access key id + secret access key). To get your access key, see [get-access-key-info](https://docs.aws.amazon.com/cli/latest/reference/sts/get-access-key-info.html) To get your authorization token, see [get-authorization-token](https://docs.aws.amazon.com/cli/latest/reference/ecr-public/get-authorization-token.html).
ebgitelman marked this conversation as resolved.
Show resolved Hide resolved
- For GCP, to get your access token, see [Create a short-lived access token](https://cloud.google.com/iam/docs/create-short-lived-credentials-direct).
- For Azure, to get your access token, see [the get-access-token command](https://learn.microsoft.com/en-us/cli/azure/account?view=azure-cli-latest#az-account-get-access-token()).
1. Connect to Postgres using your IAM credentials.
1. When prompted for the password, enter your access key (`<access key ID><secret access key>`).

### Using IAM authentication CLI commands

For information on integrating with IAM on AWS using the CLI, see [IAM authentication CLI commands](/biganimal/latest/reference/cli/using_features/#iam-authentication-cli-commands).