fix(redshift): accept IAM-federated secrets in self-hosted credential validation [SUP-532] (dev) - #348
Open
gfitzpatrick-mcd wants to merge 3 commits into
Open
Conversation
… schema
REDSHIFT_CREDENTIALS_SCHEMA required connect_args.{host, dbname, password},
so IAM-federated (Connection Auth Rules) secrets — which have no static
password (minted at connect time via GetClusterCredentials) and use db_name
not dbname — failed self-hosted credential validation. Customers had to add
a dummy password and duplicate db_name/dbname keys.
Convert connect_args to a oneof_schema with a password variant and a
federated variant (cluster_identifier/db_user/aws_region, no password) over
a shared base, mirroring the Snowflake multi-auth-mode pattern. Accept
db_name/dbname/database as aliases so any documented spelling passes.
SUP-532
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…idation Adds endpoint tests for the SUP-532 oneof_schema: an IAM-federated secret (cluster_identifier/db_user/aws_region, no password, db_name key) validates, a username/password secret validates, and a secret matching neither auth variant fails with a connect_args error. SUP-532 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ntract Addresses /code-review findings on SUP-532: - F1: assert an ambiguous secret (password + federated fields) is rejected — pins the documented oneof_schema invariant against regression. - F2: parametrized tests that db_name/dbname/database all validate under both the password and federated variants. - F3: assert the optional federated fields (assumable_role/external_id/ duration_seconds) validate. - F4: comment on RedshiftClientArgs.password noting the federated path supplies it at connect time via the auth-rule step (doc-only, no behavior change). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of the SUP-532 fix onto
dev(main PR: #346).What
Redshift self-hosted credential validation rejected IAM-federated (Connection Auth Rules) secrets: the schema required
connect_args.{host, dbname, password}, but federated secrets have no static password (minted at connect time viaGetClusterCredentials) and usedb_namenotdbname. Converts the Redshift raw-credentials schema to a cerberusoneof_schema(password variant + federated variant over a shared base), mirroring Snowflake; acceptsdb_name/dbname/databaseas aliases.Testing
Federated / password / neither-auth endpoint tests added; redshift CTP + schema suites green (72 pass), ruff clean.
Linear: SUP-532 · Customer: ZD #28116 (BBC)
🤖 Generated with Claude Code