Support AWS RDS IAM Authentication for PostgreSQL data soruce

[winebarrel]

What type of PR is this?

• Refactor
• Feature
• Bug Fix
• New Query Runner (Data Source)
• New Alert Destination
• Other

Description

Enable IAM authentication for connecting to AWS RDS in PostgreSQL data source.
see https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html

Using IAM authentication allows you to connect to the database more securely than with password authentication.

How is this tested?

• Unit tests (pytest, jest)
• E2E Tests (Cypress)
• Manually
• N/A

I added the following settings and confirmed that I could connect to the RDS for testing.

• .env

# NOTE: It is not a required environment variable.
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...

postgres=> select * from pg_stat_activity where usename = 'iam_user';
-[ RECORD 1 ]----+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
datid            | 5
datname          | postgres
pid              | 1415
leader_pid       |
usesysid         | 16455
usename          | iam_user
application_name |
client_addr      | xxx.xxx.xxx.xxx
client_hostname  |
client_port      | 62581
backend_start    | 2026-04-18 02:40:21.920859+00
xact_start       | 2026-04-18 02:40:22.062642+00
query_start      | 2026-04-18 02:40:22.062642+00
state_change     | 2026-04-18 02:40:22.062644+00
wait_event_type  | Timeout
wait_event       | PgSleep
state            | active
backend_xid      |
backend_xmin     | 21736
query_id         | -2788934432199274759
query            | /* Username: admin@example.com, query_id: 1, Queue: queries, Job ID: a8dfe938-9655-4d8f-ae84-d44725de544e, Query Hash: 8f57b28d0702e12ca964e1136c4b5e0b, Scheduled: False */ select user, pg_sleep(30) LIMIT 1000
backend_type     | client backend

Related Tickets & Documents

• Support AWS RDS IAM Authentication for Redash database #7694
• Support AWS RDS IAM Authentication for PostgreSQL data source #7304

Mobile & Desktop Screenshots/Recordings (if there are UI changes)

[cubic-dev-ai]

No issues found across 3 files

[greptile-apps]

Greptile Summary

This PR adds AWS RDS IAM authentication as an optional feature for the PostgreSQL query runner, allowing operators to connect using short-lived IAM tokens instead of a static password. The implementation is straightforward and follows the pattern already established by RedshiftIAM.

• New awsIamAuth (boolean) and awsRegion (string) fields are added to configuration_schema under extra_options; a try/except ImportError guard sets IAM_ENABLED so the runner degrades gracefully when boto3 is absent.
• In _get_connection, when awsIamAuth is enabled a fresh token is generated via boto3 generate_db_auth_token and used as the connection password; because each run_query call opens and closes its own connection, the 15-minute token expiry is never a concern.
• CockroachDB inherits from PostgreSQL without overriding configuration_schema, so the IAM auth fields will appear in its UI even though CockroachDB is not an RDS target.

Confidence Score: 5/5

• Safe to merge. The IAM auth path is additive and guarded behind an explicit awsIamAuth flag, leaving all existing PostgreSQL connections unaffected.
• The change is opt-in, the boto3 import is guarded, and a fresh token is generated per query so expiry is not a problem. No existing connection paths are altered.
• No files require special attention, though it is worth noting that CockroachDB will surface the IAM fields in its UI because it inherits configuration_schema from PostgreSQL.

Important Files Changed

Filename	Overview
redash/query_runner/pg.py	Adds AWS RDS IAM authentication support to the PostgreSQL runner: new awsIamAuth/awsRegion config fields, a try/except ImportError guard for boto3, and token generation in _get_connection. The token is freshly generated per query (connection is closed in finally), so the 15-minute expiry is not an issue. Minor: CockroachDB inherits the IAM fields from PostgreSQL without override.
uv.lock	Version bump only: redash package version incremented from 26.7.0.dev0 to 26.8.0.dev0. No dependency graph changes visible in this diff hunk.

Sequence Diagram

sequenceDiagram
    participant RQ as run_query()
    participant GC as _get_connection()
    participant BOTO as boto3 RDS client
    participant PG as psycopg2 / RDS PostgreSQL

    RQ->>GC: call
    GC->>GC: _get_ssl_config() / _parse_dsn()
    alt "awsIamAuth == True"
        GC->>BOTO: "client("rds", region_name=awsRegion)"
        BOTO-->>GC: rds_client
        GC->>BOTO: generate_db_auth_token(host, port, user)
        BOTO-->>GC: auth_token (valid 15 min)
        GC->>GC: "password = auth_token"
    else "awsIamAuth == False"
        GC->>GC: "password = configured password"
    end
    GC->>PG: psycopg2.connect(user, password, host, port, dbname, ssl_config)
    PG-->>GC: "connection (async_=True)"
    GC-->>RQ: connection
    RQ->>PG: cursor.execute(query)
    RQ->>PG: connection.close()  [finally block]

Loading

_{Reviews (5): Last reviewed commit: "Merge branch 'master' into support-rds-i..." | Re-trigger Greptile}