Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update RDS and Redshift CA URL #9890

Merged
merged 3 commits into from
Jan 24, 2022
Merged

update RDS and Redshift CA URL #9890

merged 3 commits into from
Jan 24, 2022

Conversation

greedy52
Copy link
Contributor

@greedy52 greedy52 commented Jan 21, 2022 •
edited
Loading

fixes #9887

  • AWS has updated CA cert bundles for RDS and redshift.
  • For new RDS regional bundles, they do include old certs

Testing

Tested tsh db connect successful to the following:

  • RDS Mysql instance in ca-central-1 (this uses new cert that breaks with older Teleport)
  • Aurora postgres cluster in ca-central-1 (at the time of testing, it's still using old cert so both new vs old bundle work)
  • Redshift in ca-central-1

@greedy52 greedy52 added backport-required database-access Database access related issues and PRs labels Jan 21, 2022
@greedy52 greedy52 requested a review from r0mant January 21, 2022 20:44
@greedy52 greedy52 self-assigned this Jan 21, 2022
r0mant
r0mant approved these changes Jan 21, 2022
View reviewed changes
Copy link
Collaborator

@r0mant r0mant left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@greedy52 Tried this with a few RDS/Aurora/Redshift databases I have in us-west-1, seems to work fine 👍

lib/srv/db/ca.go Outdated
return u
}
return rdsDefaultCAURL

return fmt.Sprintf("https://truststore.pki.rds.amazonaws.com/%s/%s-bundle.pem", region, region)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: Move this into a variable below? Like

rdsDefaultCAURLTemplate = "https://truststore.pki.rds.amazonaws.com/%s/%s-bundle.pem"

@greedy52 greedy52 enabled auto-merge (squash) January 24, 2022 14:19
@greedy52 greedy52 merged commit fdf921f into master Jan 24, 2022
@greedy52 greedy52 deleted the STeve/9887_update_rds_redshift_ca branch January 24, 2022 14:40
greedy52 added a commit that referenced this pull request Jan 24, 2022
@greedy52
update RDS and Redshift CA URL (#9890)
8dec55a
@greedy52 greedy52 mentioned this pull request Jan 24, 2022
Merged
greedy52 added a commit that referenced this pull request Jan 24, 2022
@greedy52
update RDS and Redshift CA URL (#9890)
4e67e4e
@greedy52 greedy52 mentioned this pull request Jan 24, 2022
Merged
greedy52 added a commit that referenced this pull request Jan 24, 2022
@greedy52
update RDS and Redshift CA URL (#9890) (#9905)
d191105
greedy52 added a commit that referenced this pull request Jan 24, 2022
@greedy52
update RDS and Redshift CA URL (#9890) (#9904)
2b481b9
@webvictim webvictim mentioned this pull request Mar 4, 2022
Closed
@alexatcanva alexatcanva mentioned this pull request Oct 13, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@r0mant r0mant r0mant approved these changes

@smallinsky smallinsky smallinsky approved these changes

@hatched hatched Awaiting requested review from hatched

Assignees

@greedy52 greedy52

Labels
backport-required database-access Database access related issues and PRs
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Fail to connect to RDS instance in ca-central-1
3 participants
@greedy52 @r0mant @smallinsky