Use custom DB roles in EventGate Lambdas

Abierto
#229 0 comentarios 0 reacciones 1 asignado Ver en GitHub

@tmikula-dev ya está trabajando en esto.

Desde el 15/9/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

enhancement

Summary

Currently, all EventGate Lambdas connect to the database using the postgres superuser. This is a significant security anti-pattern — the application should use least-privilege, role-specific database credentials instead of a superuser account.

Problem

  • Every Lambda function uses the postgres user for DB access, regardless of what operations it actually performs.
  • A compromised or buggy Lambda currently has full superuser access to the database (schema changes, other roles' data, etc.), far beyond what it needs.
  • This is effectively the worst-case DB security posture for the application.

Proposed Change

  • Update Lambdas to authenticate using the appropriate custom DB role(s) instead of postgres.
  • Custom role credentials are (or will be) stored in AWS Secrets Manager (see companion infrastructure issue in cps-eventbus-gateway for provisioning these secrets).
  • Pass the relevant Secrets Manager secret ARN into each Lambda so it can retrieve its DB credentials at runtime — likely via an environment variable (e.g. DB_SECRET_ARN), then resolved through the AWS SDK/Secrets Manager client during cold start or connection setup.
  • Ensure Lambda IAM roles are granted secretsmanager:GetSecretValue scoped to only the specific secret(s) they need.
  • Update DB connection/init code to fetch the username/password from the resolved secret instead of using hardcoded/postgres credentials.

Acceptance Criteria

  • Lambdas no longer connect to the database as postgres.
  • Each Lambda uses the custom role appropriate to its function/permissions needs.
  • Secret ARN(s) are passed into Lambdas via environment variable(s).
  • Lambda IAM permissions are scoped to only the secret(s) they require (least privilege).
  • DB connection logic updated to fetch credentials from Secrets Manager at runtime.

Dependencies

Lenguaje dominante
Python
Estrellas
4
Forks
0
Merge medio
20 h 22 min
PR fusionados (30 d)
8

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de AbsaOSS/EventGate

Todos los issues de AbsaOSS/EventGate

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.