Hey, everyone and welcome back into this video will be discussing about the IAM DB authentication.
Now this is a great feature and this basically allows us to authenticate to our database instance using
the identity and access management.
Now I am database authentication works with my SQL and Postgres Equal.
So again, it does not really work for all the types.
Only my SQL and Postgres SQL is supported as of now.
And great thing about this specific feature is that we don't really need to have a password.
Instead, we can make use of the authentication token, which in turn would be generated depending upon
the IAM policy that you assign to a specific principle.
So this is a theoretical perspective.
Let me quickly show you a demo so that this becomes much more easier for us to understand.
So this is my EC2 instance and let me quickly run a quick command and you see I am automatically logged
in.
Now, if you look into the command over here, it's a simple my SQL hyphen hyphen host and this is the
host.
So if I quickly show you the value associated with the host, whoops.
You see, it basically contains the hostname of the DB instance which we want to connect, and then
we have a enabled clear text plugin and we have a password.
So in the password field we are referencing to token.
So if I can quickly show you the token over here, this token is nothing but the signature for based
token, and this is the token which basically the authenticates the specific user with the database.
So this is what is used instead of password.
So this token that you see over here, this is a temporary token.
That means it keeps on rotating and this is not a static one.
So this is a much more better feature because now you don't really have to have a password and you can
have a temporary rotating credentials for authenticating against the database.
Now, there are certain important points to remember.
In fact, I wanted to show you a few more things we'll discuss after this slide.
Now, the first important point to remember is that the network traffic to and from the database is
encrypted with the help of the secure socket layer.
Second is you can use the IAM to centrally manage the access to your database resources instead of managing
access individually on the DB instances.
So with the help of policies you will be able to do that.
And the third point, which is quite important, which states that when you use the IM database authentication
with my SQL, you are limited to a maximum of 20 new connections per second.
So basically IMDB authentication is not a great thing to use for your production workloads.
If you have users who wants to connect to your database or application, which wants a certain temporary
connection, you can use the IMDB authentication, but make sure you do not really use this for production
in case if you want to make use of similar feature in production environment, I would recommend you
to go with the secrets manager.
Now, basically, if you want to make use of IMDB authentication, you need to enable that feature in
your database.
So let me quickly show you.
So I have a database called my DB instance, which is running.
Let me click inside it.
And here if you look into the configuration tab, let's go a bit down here.
You see IMDB authentication is enabled, so you need to make sure that this authentication is enabled.
Now, before we conclude, I wanted to show you a few quick things.
Basically, if you look into the documentation, the documentation is little incorrect.
It has a bug here.
Let me quickly show you this.
So here it says that the IM database authentication is available for the following database engines
and instance types.
And here it says my SQL 5.6 minor.
Now it says all instance classes are supported except for the db, D two point micro and dvd2 not small
and DBM one not small.
So if you read here you'll be able to see that all the instance class except these ones are supported
for the IAM database authentication.
But that is not the case.
Even the db ht two point micro and DV two dot small is supported for the IMDB authentication.
In fact, if you look into this database instance, this database instance is of type PT too small,
and here the IMDB authentication is working correctly.
I assume that the documentation team will just fix this part.
Anyways, I just thought to share because otherwise it would be a little confusing.
So this is the high level overview about what IAM DB authentication is all about.
Now in the next video we'll start from scratch and we'll look into how exactly we can configure the
IMDB authentication and how we can log in to the database with the same.
So with this will conclude this video.
I hope this high level overview video has been informative for you and I look forward to see you in
the next practical video.