Add support for AWS IAM authentication to RDS instances

[wronghost]

This pull request introduces AWS RDS IAM authentication support for the SQL storage backend, enabling secure database connections using temporary IAM tokens instead of static passwords. The implementation is opt-in, backward compatible, and includes comprehensive documentation, configuration options, and automated token management for both PostgreSQL and MySQL. Several new files, configuration parameters, and dependencies have been added to support this feature.

Major features and changes:

1. AWS RDS IAM Authentication Implementation

• Added new implementation in storage/rds_iam.go for managing IAM token generation, connection string modification, and background token refresh logic.
• Unit tests (storage/rds_iam_test.go), documentation (storage/RDS_IAM_AUTHENTICATION.md), and example configuration (storage/rds_iam_example_config.yaml) have been included.
• Quick start guide provided in storage/QUICKSTART_RDS_IAM.md for rapid setup and troubleshooting.

2. Configuration and Usage

• New configuration options added for enabling and customizing RDS IAM authentication (storage.sql.rdsiam.enabled, region, dbuser, tokenrefreshinterval) with detailed descriptions in README.rst.
• Example YAML configuration and usage instructions provided in documentation. [1] [2]

3. Codebase and Dependency Updates

• storage/config.go and storage/engine.go updated to integrate RDS IAM authentication, including token management and background refresh routines.
• AWS SDK v2 dependencies added to go.mod to enable IAM token generation and AWS integration. [1] [2]

4. Security and Compatibility

• No passwords stored in configuration when IAM is enabled; relies on AWS credential chain and best practices.
• Feature is fully backward compatible and disabled by default, ensuring no breaking changes for existing users.

5. Documentation and Testing

• Comprehensive documentation and testing provided, including implementation summary, setup guides, and passing unit tests for all new logic. [1] [2]

These changes collectively provide a secure, automated, and well-documented way to use AWS RDS IAM authentication with the Nuts node SQL storage backend.

[qltysh]

Coverage Impact

⬇️ Merging this pull request will decrease total coverage on master by 0.19%.

Modified Files with Diff Coverage (4)

Rating	File	% Diff	Uncovered Line #s
	storage/config.go	100.0%
	storage/engine.go	32.1%	124-125, 260-266...
	storage/cmd/cmd.go	0.0%	50-60
	storage/rds_iam.go	59.2%	37-43, 68-69, 79-80...
	Total	50.7%

🤖 Increase coverage with AI coding...

In the `master` branch, add test coverage for this new code:

- `storage/cmd/cmd.go` -- Line 50-60
- `storage/engine.go` -- Lines 124-125, 260-266, 275, 284-289, and 302-517
- `storage/rds_iam.go` -- Lines 37-43, 68-69, 79-80, 85-86, 109, 115-116, 123-124, 129-130, 140-141, 147-148, 162-163, and 212-253

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[reinkrul]

move to storage.DefaultConfig()

[wronghost]

I have move that default values to:

	return Config{
		SQL: SQLConfig{
			RDSIAM: RDSIAMConfig{
				TokenRefreshInterval: 14 * time.Minute,
			},
		},
	}


Not sure if this is what you have expected. 

[reinkrul]

Would it be possible to integration test or even end-to-end test against a stub AWS RDS IAM? Since you're the first one requiring this feature, and thus the only one using it, we have a future maintenance risk if it breaks at some point (and we won't even notice it breaking because there's no itnegration test).

[wronghost]

Hi,

I have tried to fix all the recommendation which you have asked. Not sure only about:

	return Config{
		SQL: SQLConfig{
			RDSIAM: RDSIAMConfig{
				TokenRefreshInterval: 14 * time.Minute,
			},
		},
	}

I build a code locally and have tested it directly with our acceptance database on AWS using RDS IAM authentication and after those changes i was able still to push some records using commands:

curl -Lvs  -X POST http://localhost:8081/internal/vdr/v2/subject

and retrieve records:

curl -Lvs  http://localhost:8081/internal/vdr/v2/subject

Seems to be fine so far.

Could you please review once again and let me know if there are more things to correct.
Thank you in advance.