diff --git a/examples/RDS MFA Test/README.md b/examples/RDS MFA Test/README.md new file mode 100644 index 0000000..3bd547d --- /dev/null +++ b/examples/RDS MFA Test/README.md @@ -0,0 +1,91 @@ + +1. **Enable IAM authentication on the Postgres DB instance or Aurora Postgres Cluster** + +**Terraform:** + +Set iam\_database\_authentication\_enabled = true within the Instance or the Cluster resource and apply. + +**Console:** + +* 1. Enable IAM Authentication on the DB Instance + 1. Go to **RDS Console** → Select your **DB instance or the Cluster**. + 2. Choose **Modify**. + 3. Scroll to **Database Authentication**. + 4. Set **IAM DB authentication** to **Enabled**. + 5. Click **Continue** → **Apply Immediately** or during the next maintenance window. + 6. This allows the DB instance to accept IAM token-based logins + +**CLI:** + +aws rds modify-db-instance \ + --db-instance-identifier \ + --enable-iam-database-authentication \ + --apply-immediately + +aws rds modify-db-cluster \ + --db-cluster-identifier your-aurora-cluster-identifier \ + --enable-iam-database-authentication \ + --apply-immediately + +1. **Create IAM User/Role and assign IAM Policy (Please Confirm with Matt Morgan from SCT - INC000003161057)** + +Policy: + +For RDS: + +{ + "Version" : "2012-10-17", + "Statement" : + [ + { + "Effect" : "Allow", + "Action" : ["rds-db:connect"], + "Resource" : ["arn:aws:rds-db:us-east-1:123456789012:dbuser:db-ABCDEFGHIJKL01234/mydbuser"] + } + ] +} +For Aurora: + +{ + "Version" : "2012-10-17", + "Statement" : + [ + { + "Effect" : "Allow", + "Action" : ["rds-db:connect"], + "Resource" : ["arn:aws:rds-db:us-east-1:123456789012:dbuser:cluster-ABCDEFGHIJKL01234/mydbuser"] + } + ] +} + +1. **Enable IAM authentication for the database JBID user** + +Grant rds\_iam to ; + +1. Launch the URL from production network to access AWS Console using Identity Center + + + +![](images/image_1.png) + +Once verified via the phone Okta verify app, successfully logged in. + +![](images/image_2.png) + +![](images/image_3.png) + +Retrieve the Access keys: + +![](images/image_4.png) + +Generate DB token after setting the keys in Power shell or Command prompt. + +![](images/image_5.png) + +![](images/image_6.png) + +Copy the token and paste in the password box in PGADMIN or DBeaver tools. + +Token can be obtained only after getting authenticated with MFA. + +Login should be successful. diff --git a/examples/RDS MFA Test/images/image_1.png b/examples/RDS MFA Test/images/image_1.png new file mode 100644 index 0000000..30ea7ce Binary files /dev/null and b/examples/RDS MFA Test/images/image_1.png differ diff --git a/examples/RDS MFA Test/images/image_2.png b/examples/RDS MFA Test/images/image_2.png new file mode 100644 index 0000000..0e43b5a Binary files /dev/null and b/examples/RDS MFA Test/images/image_2.png differ diff --git a/examples/RDS MFA Test/images/image_3.png b/examples/RDS MFA Test/images/image_3.png new file mode 100644 index 0000000..fe0770e Binary files /dev/null and b/examples/RDS MFA Test/images/image_3.png differ diff --git a/examples/RDS MFA Test/images/image_4.png b/examples/RDS MFA Test/images/image_4.png new file mode 100644 index 0000000..b218433 Binary files /dev/null and b/examples/RDS MFA Test/images/image_4.png differ diff --git a/examples/RDS MFA Test/images/image_5.png b/examples/RDS MFA Test/images/image_5.png new file mode 100644 index 0000000..9d36228 Binary files /dev/null and b/examples/RDS MFA Test/images/image_5.png differ diff --git a/examples/RDS MFA Test/images/image_6.png b/examples/RDS MFA Test/images/image_6.png new file mode 100644 index 0000000..4c6e1ce Binary files /dev/null and b/examples/RDS MFA Test/images/image_6.png differ diff --git a/examples/RDS MFA Test/images/temp b/examples/RDS MFA Test/images/temp new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/examples/RDS MFA Test/images/temp @@ -0,0 +1 @@ +