Support for DSQL #7
Description
Problem Statement
The current version of the sqlalchemy-rdsiam library only supports IAM authentication for traditional Amazon RDS engines (MySQL and PostgreSQL). This limits applications built with SQLAlchemy from leveraging IAM authentication when connecting to newer AWS services like Aurora DSQL. Developers who want to use Distributed SQL capabilities with secure, credential-less authentication are unable to use this library for DSQL clusters
Proposed Solution
Expand the sqlalchemy-rdsiam library to support IAM authentication for Aurora DSQL clusters. This would require the implementation of a DSQL-compatible SQLAlchemy dialect and support for DSQL-specific endpoints and connection flow. The updated library would automatically detect whether the target database is an RDS or DSQL instance, handling IAM token generation and connection creation appropriately for both types. Full async engine support and SSL configuration options should also be included
Alternatives Considered
- Use aurora-dsql-sqlalchemy for Aurora DSQL, but this requires maintaining two separate packages and duplicate configuration logic for IAM authentication.
- Build custom connection code for DSQL in each application, which is error-prone and increases maintenance burden.
- Employ a cloud proxy (RDS Proxy or custom solution), which adds latency, cost, and operational complexity.
Each alternative either fragments the codebase or introduces overhead. Unified support within sqlalchemy-rdsiam would greatly simplify IAM authentication for all AWS relational database services
Additional Context
AWS has prioritized Distributed SQL (DSQL) in Aurora for scalability and performance. Many Python applications want to migrate or support both legacy RDS and Aurora DSQL using a single code path. Broadening sqlalchemy-rdsiam would foster easier migrations, improve developer experience, and encourage secure database practices in cloud environments