Support a password function for the client configuration

If you use e.g. AWS Aurora Postgres with IAM authentication it is hard to deal with it in the code.

It would be nice that I can use a function to return the password, like this:

const signer: RDS.Signer = ...
const params: RDS.Signer.SignerOptions = ...

return new pg.Pool({
  max: 1,
  host: databaseConnection.clusterEndpoint,
  port: databaseConnection.port,
  database: databaseConnection.database,
  user: databaseConnection.username,
  password: async () => signer.getAuthToken(params),
  ssl: true,
});

[mikicho]

set the rejectUnauthorized to true

I guess you mean false (it’s working! thanks!) I’ll check what we need to do to validate the certificate for better security.

[sehrope]

psql defaults to enabling SSL but not checking the server’s certificate: https://www.postgresql.org/docs/current/libpq-ssl.html (“prefer” mode)

This driver was changed a few versions back to be more secure by default so the default is to reject untrusted certificates. To mimic the “prefer” behavior, set the rejectUnauthorized to true. Or, even better, specify the CA certificates for your database so the server’s certificate is validated.