FireDAC Components for Amazon S3

Build 21.0.7930

Establishing a Connection

You can create and manage connections with the Data Explorer and the FireDAC Connection Editor wizards. See Connection Definitions for more information on creating connections from code and creating persistent, private, or temporary connections.

Connecting to Amazon S3

Specify the following to connect to data:

  • CustomURL: Specify the base S3 service URL if it has a different URL from 'amazonaws.com'. Make sure to specify the full URL. For example: 'http://127.0.0.1:9000'.
  • AWSRegion: Set this to the region where your Amazon S3 data is hosted.

Authenticating to Amazon S3

There are several authentication methods available for connecting to Amazon S3 including: authenticating with Root Credentials, Temporary Credentials, as an AWS Role (from an EC2 Instance or by specifying the root credentials), using SSO and using a Credential File.

Obtaining the Access Key

To obtain the credentials for an IAM user, follow the steps below:

  1. Sign into the IAM console.
  2. In the navigation pane, select Users.
  3. To create or manage the access keys for a user, select the user and then select the Security Credentials tab.

To obtain the credentials for your AWS root account, follow the steps below:

  1. Sign into the AWS Management console with the credentials for your root account.
  2. Select your account name or number and select My Security Credentials in the menu that is displayed.
  3. Click Continue to Security Credentials and expand the Access Keys section to manage or create root account access keys.

Authenticating with Root Credentials

To authenticate using account root credentials, set the following:

  • AuthScheme: Set this to AwsRootKeys.
  • AWSAccessKey: The access key associated with the AWS root account.
  • AWSSecretKey: The secret key associated with the AWS root account.

Note: Use of this authentication scheme is discouraged by Amazon for anything but simple tests. The account root credentials have the full permissions of the user, making this the least secure authentication method.

Authenticating with Temporary Credentials

To authenticate using temporary credentials, specify the following:

  • AuthScheme: Set this to TemporaryCredentials.
  • AWSAccessKey: The access key of the IAM user to assume the role for.
  • AWSSecretKey: The secret key of the IAM user to assume the role for.
  • AWSSessionToken: Your AWS session token. This will have been provided alongside your temporary credentials. See this link for more info.

The component can now request resources using the same permissions provided by long-term credentials (such as IAM user credentials) for the lifespan of the temporary credentials.

If you are also using an IAM role to authenticate, you must additionally specify the following:

  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the component to attempt to retrieve credentials for the specified role.
  • AWSExternalId: Only if required when you assume a role in another account.

Authenticating from an EC2 Instance

If you are using the component from an EC2 Instance and have an IAM Role assigned to the instance, you can use the IAM Role to authenticate. To do so, set the following properties to authenticate:

  • AuthScheme: Set this to AwsEC2Roles.
Do not specify AWSAccessKey and AWSSecretKey because the component will automatically obtain your IAM Role credentials and authenticate with them.

If you are also using an IAM role to authenticate, you must additionally specify the following:

  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the component to attempt to retrieve credentials for the specified role.
  • AWSExternalId: Only if required when you assume a role in another account.

Authenticating as an AWS Role

In many situations it may be preferable to use an IAM role for authentication instead of the direct security credentials of an AWS root user.

To authenticate as an AWS role, set the following:

  • AuthScheme: Set this to AwsIAMRoles.
  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the component to attempt to retrieve credentials for the specified role.
  • AWSExternalId: Only if required when you assume a role in another account.
  • AWSAccessKey: The access key of the IAM user to assume the role for.
  • AWSSecretKey: The secret key of the IAM user to assume the role for.

Note: Roles may not be used when specifying the AWSAccessKey and AWSSecretKey of an AWS root user.

Authenticating with ADFS

Set the AuthScheme to ADFS. The following connection properties need to be set:

  • User: Set this to the ADFS user.
  • Password: Set this to ADFS password for the user.
  • SSOLoginUrl: Set this to the login url used by the SSO provider.
Below is an example connection string:
AuthScheme=ADFS; AWSRegion=Ireland; User=user@cdata.com; Password=CH8WerW121235647iCa6; SSOLoginUrl='https://adfs.domain.com'; AWSRoleArn=arn:aws:iam::1234:role/ADFS_SSO; AWSPrincipalArn=arn:aws:iam::1234:saml-provider/ADFSProvider;

ADFS Integrated

The ADFS Integrated flow indicates you are connecting with the currently logged in Windows user credentials. To use the ADFS Integrated flow, simply do not specify the User and Password, but otherwise follow the same steps in the ADFS guide above.

Authenticating with Okta

Set the AuthScheme to Okta. The following connection properties are used to connect to Okta:

  • User: Set this to the Okta user.
  • Password: Set this to Okta password for the user.
  • SSOLoginUrl: Set this to the login url used by the SSO provider.
The following SSOProperties are needed to authenticate to Okta:
  • APIToken (optional): Set this to the API Token that the customer created from the Okta org. It should be used when authenticating a user via a trusted application or proxy that overrides OKTA client request context.

The following is an example connection string:

AuthScheme=Okta; AWSRegion=Ireland; User=user@cdata.com; Password=CH8WerW121235647iCa6; SSOLoginUrl='https://cdata-us.okta.com/home/amazon_aws/0oa35m8arsAL5f5NrE6NdA356/272'; SSOProperties='ApiToken=01230GGG2ceAnm_tPAf4MhiMELXZ0L0N1pAYrO1VR-hGQSf;'; AWSRoleArn=arn:aws:iam::1234:role/Okta_SSO; AWSPrincipalARN=arn:aws:iam::1234:saml-provider/OktaProvider;

Authenticating with PingFederate

Set the AuthScheme to PingFederate. The following connection properties need to be set:

  • User: Set this to the PingFederate user.
  • Password: Set this to PingFederate password for the user.
  • SSOLoginUrl: Set this to the login url used by the SSO provider.
  • SSOExchangeUrl: The 'Partner Service Identifier' URI configured in your PingFederate server instance under: SP Connections > SP Connection > WS-Trust > Protocol Settings. This should uniquely identify a PingFederate SP Connection, so it is a good idea to set it to your 'AWS SSO ACS URL'. You can find it under AWS SSO > Settings > Click on 'View Details' next to the Authentication field.
The following SSOProperties are needed to authenticate to PingFederate:
  • AuthScheme (optional): The authorization scheme to be used for the IdP endpoint. The allowed values for this IdP are None or Basic.
Additionally, you can use the following SSOProperties to configure mutual SSL authentication for SSOLoginUrl, the WS-Trust STS endpoint:
  • SSLClientCert
  • SSLClientCertType
  • SSLClientCertSubject
  • SSLClientCertPassword
Below is an example connection string:
authScheme=pingfederate;SSOLoginUrl=https://mycustomserver.com:9033/idp/sts.wst;SSOExchangeUrl=https://us-east-1.signin.aws.amazon.com/platform/saml/acs/764ef411-xxxxxx;user=admin;password=PassValue;AWSPrincipalARN=arn:aws:iam::215338515180:saml-provider/pingFederate;AWSRoleArn=arn:aws:iam::215338515180:role/SSOTest2;

Authenticating with MFA

For users and roles that require Multi-factor Authentication, specify the following to authenticate:

  • AuthScheme: Set this to AwsMFA.
  • CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
  • MFASerialNumber: The serial number of the MFA device if one is being used.
  • MFAToken: The temporary token available from your MFA device.
If you are connecting to AWS (instead of already being connected such as on an EC2 instance), you must additionally specify the following:
  • AWSAccessKey: The access key of the IAM user for whom MFA will be issued.
  • AWSSecretKey: The secret key of the IAM user whom MFA will be issued.
If you are also using an IAM role to authenticate, you must additionally specify the following:
  • AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the component to attempt to retrieve credentials for the specified role using MFA.
  • AWSExternalId: Only if required when you assume a role in another account.
This will cause the component to submit the MFA credentials in a request to retrieve temporary authentication credentials.

Note that the duration of the temporary credentials may be controlled via the TemporaryTokenDuration property (default 3600 seconds).

Authenticating with a Credential File

You may use a credentials file to authenticate. Any configurations related to AccessKey/SecretKey authentication, temporary credentials, role authentication, or MFA will be used. To do so, set the following properties to authenticate:

  • AuthScheme: Set this to AwsCredentialsFile.
  • AWSCredentialsFile: Set this to the location of your credentials file.
  • AWSCredentialsFileProfile: Optionally set this to the name of the profile you would like to use from the specified credentials file. If not specified, the profile with the name default will be used.
See this link for more information.

Using the FireDAC Connection Editor

Complete the following steps to use the FireDAC Connection Editor to assign a Amazon S3 connection to a TFDConnection object:

  1. Open a project and drop a TFDPhysCDataAmazonS3DriverLink from the Tool Palette onto the Form Designer.
  2. Drop a TFDConnection object onto the Form Designer.
  3. Double-click the TFDConnection and select CDataAmazonS3 in the Driver Id menu.
  4. Define the necessary connection properties.
  5. To execute ad-hoc SQL statements based on this connection, enter SQL commands on the SQL Script tab.
  6. In the Form Designer, select the TFDConnection object and set the Connected property to true.

Using the Data Explorer

Complete the following steps to use the Data Explorer to define persistent connections that can be shared across applications and projects:

  1. Click View > Tool Windows > Data Explorer in RAD Studio and expand the FireDAC node.
  2. Right-click the CData Amazon S3 Data Source node and click Add New Connection.
  3. Enter a name for the connection. The FireDAC Connection Editor opens.

Working with Persistent Connections

The connections you define in the Data Explorer can be assigned to a TFDConnection object by specifying the connection name in the TFDConnection object's ConnectionDefName property.

Browsing Data and Metadata

The Data Explorer also provides options for browsing Amazon S3 objects at design time:

  • Expand the CData Amazon S3 Data Source node in the Data Explorer to view the defined connections.
  • Expand a connection node to find the database objects available for a connection.
  • Drill down to a database object to find metadata such as primary keys.
  • To display data, double-click a table or view or right-click and click View.

Copyright (c) 2021 CData Software, Inc. - All rights reserved.
Build 21.0.7930