getRDSCertPool downloads and returns the RDS CA certificate pool. AWS RDS connection with IAM require TLS connection. refs: https://github.com/aws/aws-sdk-go/issues/1248 https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/mysql-ssl-connections.html
(ctx context.Context)
| 161 | // https://github.com/aws/aws-sdk-go/issues/1248 |
| 162 | // https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/mysql-ssl-connections.html |
| 163 | func getRDSCertPool(ctx context.Context) (*x509.CertPool, error) { |
| 164 | req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem", nil) |
| 165 | if err != nil { |
| 166 | return nil, errors.Wrapf(err, "failed to build request for rds cert") |
| 167 | } |
| 168 | |
| 169 | client := &http.Client{} |
| 170 | resp, err := client.Do(req) |
| 171 | if err != nil { |
| 172 | return nil, err |
| 173 | } |
| 174 | defer resp.Body.Close() |
| 175 | |
| 176 | pem, err := io.ReadAll(resp.Body) |
| 177 | if err != nil { |
| 178 | return nil, err |
| 179 | } |
| 180 | |
| 181 | if err := resp.Body.Close(); err != nil { |
| 182 | return nil, errors.Wrapf(err, "failed to close response") |
| 183 | } |
| 184 | |
| 185 | rootCertPool := x509.NewCertPool() |
| 186 | if ok := rootCertPool.AppendCertsFromPEM(pem); !ok { |
| 187 | return nil, errors.Errorf("failed to parse RDS CA certificates") |
| 188 | } |
| 189 | |
| 190 | return rootCertPool, nil |
| 191 | } |
| 192 | |
| 193 | // getRDSConnection returns the connection string with IAM for AWS RDS. |
| 194 | // |
no test coverage detected