AWS IAM role authentication for ClickPipes

​

Before you begin

• Your ClickHouse Cloud service must run on AWS to use IAM role authentication.
• You need permission to create and configure IAM roles in the AWS account that owns the source.
• For RDS or Aurora database authentication, you also need permission to enable IAM database authentication and configure a database user.

​

How it works

1. Find the Service role ID (IAM) for your ClickHouse Cloud service under Settings → Network security information. This ARN identifies the role that ClickPipes uses to request access.
2. Create a role in your AWS account and trust the ClickHouse service role to assume it.
3. Grant that role the permissions required by your source, following its setup guide below.
4. Configure the ClickPipe to use the ARN of the role you created. ClickPipes assumes that role when connecting to the source.

​

Configure the trust policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "{ClickHouse_IAM_ARN}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

​

Choose your source