feat(pam): iam auth for postgres

[x032205]

Description 📣

iam auth for postgres

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[linear]

PAM-408

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-366-feat-pam-iam-auth-for-postgres

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

[greptile-apps]

Greptile Summary

This PR adds PostgreSQL AWS IAM authentication to PAM sessions and gateway connection tests by assuming an account role and generating an RDS authentication token.

• Extends PAM credential payloads with AWS region and role ARN fields.
• Adds cached AWS configuration loading, STS AssumeRole, and RDS token generation.
• Injects generated tokens into PostgreSQL proxy sessions and SQL connection tests.
• Promotes the required AWS SDK modules to direct dependencies.

Confidence Score: 4/5

The PR appears safe to merge, with non-blocking concerns around IAM connection-test timeout budgeting and the unbounded region configuration cache.

IAM token preparation can consume nearly the entire connection-test deadline before PostgreSQL is contacted, while distinct request region values remain cached for the lifetime of the gateway.

Files Needing Attention: packages/gateway-v2/test_connection_handler.go, packages/pam/aws_rds_auth.go

Important Files Changed

Filename	Overview
packages/pam/aws_rds_auth.go	Adds AWS configuration caching, role assumption, and RDS token generation; the cache is unbounded and token generation can consume the connection test's full timeout.
packages/gateway-v2/test_connection_handler.go	Adds IAM token generation before PostgreSQL connection testing, making AWS setup and database verification share one timeout budget.
packages/pam/pam-proxy.go	Generates and injects an RDS IAM token for PostgreSQL sessions while preserving password authentication for other methods.
packages/pam/session/credentials.go	Propagates AWS region and role ARN from the API credential response into cached PAM session credentials.
packages/api/model.go	Extends the PAM session credential API model with optional AWS IAM configuration fields.
go.mod	Adds the AWS RDS authentication module and promotes directly imported AWS SDK modules to direct dependencies.

_{Reviews (1): Last reviewed commit: "feat(pam): iam auth for postgres" | Re-trigger Greptile}