aurora-data-api 0.0.2

Installation

pip install aurora-data-api

Prerequisites

• Set up an AWS Aurora Serverless cluster and enable Data API access for it. If you have previously set up an Aurora Serverless cluster, you can enable Data API with the following AWS CLI command:

  aws rds modify-db-cluster --db-cluster-identifier DB_CLUSTER_NAME --enable-http-endpoint --apply-immediately

• Save the database credentials in AWS Secrets Manager using a format expected by the Data API (a JSON object with the keys username and password):

  aws secretsmanager put-secret-value --secret-id MY_DB_CREDENTIALS --secret-string "$(jq -n '.username=env.PGUSER | .password=env.PGPASSWORD')"

• Configure your AWS command line credentials using standard AWS conventions.

Usage

Use this module as you would use any DB-API compatible driver module. The aurora_data_api.connect() method is the standard main entry point, and accepts two implementation-specific keyword arguments:

• aurora_cluster_arn (also referred to as resourceArn in the Data API documentation)

• secret_arn (the database credentials secret)

import aurora_data_api

cluster_arn = "arn:aws:rds:us-east-1:123456789012:cluster:my-aurora-serverless-cluster"
secret_arn = "arn:aws:secretsmanager:us-east-1:123456789012:secret:MY_DB_CREDENTIALS"
with aurora_data_api.connect(aurora_cluster_arn=cluster_arn, secret_arn=secret_arn, database="my_db") as conn:
    with conn.cursor() as cursor:
        cursor.execute("select * from pg_catalog.pg_tables")
        print(cursor.fetchall())

Motivation

The RDS Data API is the link between the AWS Lambda serverless environment and the sophisticated features provided by PostgreSQL and MySQL. The Data API tunnels SQL over HTTP, which has advantages in the context of AWS Lambda:

• It eliminates the need to open database ports to the AWS Lambda public IP address pool

• It uses stateless HTTP connections instead of stateful internal TCP connection pools used by most database drivers (the stateful pools become invalid after going through AWS Lambda freeze-thaw cycles, causing connection errors and burdening the database server with abandoned invalid connections)

• It uses AWS role-based authentication, eliminating the need for the Lambda to handle database credentials directly

Links

• Project home page (GitHub)

• Documentation (Read the Docs)

• Package distribution (PyPI)

• Change log

License

Licensed under the terms of the Apache License, Version 2.0.