AWS Brings Trusted Extension Support to Managed Postgres
LAS VEGAS — Cloud giant Amazon Web Services has launched Trusted Language Extensions for PostgreSQL, a security tool that allows developers to build high-performance extensions securely on an AWS-managed Postgres database system, using their favorite languages.
AWS launched a new security tool during the third day of AWS’s re:Invent conference, held this week in Las Vegas.
Trusted Language Extensions for PostgreSQL is an open source development kit that lets developers install extensions written in their preferred language, with built-in safety guardrails, that can run on Amazon Aurora PostgreSQL-Compatible Edition and Amazon Relational Database Service (RDS) for PostgreSQL.
According to an accompanying blog post, written by Channy Yun, principal developer advocate at AWS, Trusted Language extensions give “database administrators control over who can install extensions and a permissions model for running them, letting application developers deliver new functionality as soon as they determine an extension meets their needs.”
Solving Security and Compliance Pain
David Nalley, AWS head of open source strategy and marketing, sat down with The New Stack to discuss the product right after the launch. His passion for the project was easy to see when he called it, “the most exciting announcement of the week so far for me, because that solves a significant security and compliance pain for anyone who’s using PostgreSQL at any kind of scale.”
He pointed out the need for a tool like this: “If you’re running more than one database, or you need one more than one integration, it solves a significant problem set for you, because it essentially gives you a way of creating a set of scaffolding to keep things in place.
“And especially from a security perspective, because PostgreSQL Extensions essentially are trusted.”
This was another instance of innovation being born from need. Nally said: “Our customers were telling us that they wanted to be able to run extensions inside RDS and inside Aurora.”
‘Security by Creating Boundaries’
On its face, that sounds simple enough. But custom extensions come with huge security risks. AWS made it clear at this re:Invent that security was very important, so it wasn’t going to grant access to unfamiliar code, especially when the access granted would be at the same security level as the PostgreSQL database itself. That was a no-go.
But AWS didn’t want to give customers a “no” on this one and walk away. So its developers went back to the drawing board, to create a solution that offers customers the opportunity to write extensions but also keep security at the level where it needs to be. The solution was extensions but with guardrails. Nally explained it concisely: “security by creating boundaries.”
Before the finished product was created, there were a few technical changes to overcome. “One of the things that we spent a lot of time focusing on, was making sure [it] would be really compatible with how upstream PostgreSQL operates,” Nally said. A lot of early design time went into this.
And then there was the challenge of defining the boundaries. There were no “safe” extensions before, so this concept was completely invented by Nally and his team. Creating the definition of safe was a big challenge for them.
Most of the commonly used languages today are supported — including JavaScript, Perl, and PL/pgSQL. AWS open sourced the product because, Nally said, it wanted to “provide people something that would dramatically reduce the complexity obviously for RDS customers, but also, it’s also a really big problem for DBAs who are running PostgreSQL.”
This product is currently live on GitHub and available for consumption.
