Configure AWS passwordless authentication using Amazon RDS PostgreSQL as the Metastore

• The Amazon RDS instance must have the IAM authentication method enabled.
• A user must be created in the Amazon RDS database and given the role rds_iam.
• A matching user must be created in AWS with permission to connect to Amazon RDS.
• The ec-2 instance to which Collibra Data Quality & Observability is deployed must have permission to connect to Amazon RDS.

Tip For more information, see the official AWS documentation on Using IAM Authentication with PostgreSQL and Creating and using an IAM policy for IAM database access .

• The Amazon RDS instance must have the IAM authentication method enabled.
• A user must be created in the Amazon RDS database and given the role rds_iam.
• A matching user must be created in AWS with permission to connect to Amazon RDS.
• The EKS instance to which Collibra Data Quality & Observability is deployed must have permission to connect to Amazon RDS.

Tip For more information, see the official AWS documentation on Using IAM Authentication with PostgreSQL and Creating and using an IAM policy for IAM database access .

1. Open the owl-env.sh file.
2. Export the Spring profile "AWS_ENV" environment variable with the following command:
   • export SPRING_PROFILES_ACTIVE=AWS_ENV
3. Export the Spring data source URL environment variables with the following commands, replacing the parameterized ${RDS-url} sections with your Amazon RDS JDBC URL:
• export SPRING_DATASOURCE_URL=${RDS-url}
• export SPRING_AGENT_DATASOURCE_URL=${RDS-url}
4. Export the Spring data source username environment variables with the following commands, replacing the parameterized ${RDS-username} sections with the Amazon RDS username configured with the profile rds_iam:
• export SPRING_DATASOURCE_USERNAME=${RDS-username}
• export SPRING_AGENT_DATASOURCE_USERNAME=${RDS-username}
5. Export the Spring data source password environment variables with the following commands, replacing the parameterized ${value} sections with a non-empty value:
• export SPRING_DATASOURCE_USERNAME=${value}
• export SPRING_AGENT_DATASOURCE_USERNAME=${value}

Note The password properties are not used for the connection, but Collibra Data Quality & Observability requires them to be present.

6. Save and close the owl-env.sh file.
7. Open the owl.properties file.
8. Append the authenticationPluginClassName=com.owl.common.datasource.aws.AwsPostgresAuthenticationPlugin argument to the spring.datasource.url property in the configuration file, similar to the valid Spring data source URL shown in the following example:

Example 
spring.datasource.url=jdbc:postgresql://my-rds-instance.xyz.us-east-1.rds.amazonaws.com:5432/mydatabasename?authenticationPluginClassName=com.owl.common.datasource.aws.AwsPostgresAuthenticationPlugin

9. Add the following properties to the configuration file:
Copy

# Replace {RDS_username} with the Amazon RDS username configured with the profile rds_iam
spring.datasource.username={RDS_username}

# Replace {value} with a non-empty value
spring.datasource.password={value}

10. Save and close the owl.properties file.
11. Restart the Collibra Data Quality & Observability Web App.

1. Deploy Collibra Data Quality & Observability with the following Helm Chart variables, replacing the parameterized ${value} sections with your AWS RDS Metastore details:
Copy

--set global.configMap.data.active_profile=AWS_ENV
--set global.configMap.data.metastore_url="${value}"
--set global.configMap.data.metastore_user="${value}"
--set global.configMap.data.metastore_pass="${value}"

2. Validate that the dq-agent and dq-web pods restarted with the appropriate configuration values after the deployment completes.