diff --git a/connections/aws-iam.mdx b/connections/aws-iam.mdx index f274acf2..feb0651a 100644 --- a/connections/aws-iam.mdx +++ b/connections/aws-iam.mdx @@ -105,6 +105,10 @@ mydb.abc123.us-east-1.rds.amazonaws.com:5432 The port is optional, falling back to 5432 for PostgreSQL and 3306 for MySQL and MariaDB. The field also covers a CNAME or any alias AWS did not issue, and is honored only when **Host** is loopback or already the same hostname. +## On iPhone and iPad + +Synced connections keep their AWS IAM option. **AWS IAM (Profile)** needs an access key saved on the device, and **AWS IAM (SSO)** signs in to IAM Identity Center from the device itself. [IAM sign-in](/ios#iam-sign-in) covers the setup. + ## Troubleshooting ### Could not determine an AWS region for "…" diff --git a/connections/cloud-sql-proxy.mdx b/connections/cloud-sql-proxy.mdx index 3b7e96ee..4c7d6e19 100644 --- a/connections/cloud-sql-proxy.mdx +++ b/connections/cloud-sql-proxy.mdx @@ -93,6 +93,8 @@ gcloud sql users create name@example.com --instance=INSTANCE --type=cloud_iam_us These options also work with **Connect via > Cloud SQL Auth Proxy**. SSL then stays as set, because the proxy encrypts the connection to the instance. +A connection synced to an iPhone or iPad keeps its method, and **Application Default** there needs a service account key for that device: see [IAM sign-in](/ios#iam-sign-in). + ## Troubleshooting ### cloud-sql-proxy was not found diff --git a/development/plugin-development.mdx b/development/plugin-development.mdx index 81159782..2ddb5b4b 100644 --- a/development/plugin-development.mdx +++ b/development/plugin-development.mdx @@ -13,7 +13,7 @@ A plugin is a macOS loadable bundle target with `WRAPPER_EXTENSION = tableplugin | Key | Type | Required | Purpose | |-----|------|----------|---------| -| `TableProPluginKitVersion` | integer | Yes | The PluginKit ABI the plugin was built against. Current value: 39 | +| `TableProPluginKitVersion` | integer | Yes | The PluginKit ABI the plugin was built against. Current value: 40 | | `TableProProvidesDatabaseTypeIds` | array of strings | Recommended | Database type IDs the plugin serves, which is what makes lazy loading possible | | `CFBundleShortVersionString` | string | Yes | Plugin version shown in **Settings > Plugins** | | `CFBundleVersion` | string | Yes | Build number. Of two copies of a plugin the higher build loads, and a registry update needs a higher build | diff --git a/images/ios-iam-sign-in-dark.png b/images/ios-iam-sign-in-dark.png new file mode 100644 index 00000000..d9736600 Binary files /dev/null and b/images/ios-iam-sign-in-dark.png differ diff --git a/images/ios-iam-sign-in.png b/images/ios-iam-sign-in.png new file mode 100644 index 00000000..f81fa840 Binary files /dev/null and b/images/ios-iam-sign-in.png differ diff --git a/ios/index.mdx b/ios/index.mdx index 066f3a1b..8cd63365 100644 --- a/ios/index.mdx +++ b/ios/index.mdx @@ -97,6 +97,31 @@ Picking a SQLite file copies it into the app, and edits go to that copy, so the A database created with **Create New Database**, or copied in by picking it, stays with its connection through an app update and a restore from backup. A file that is gone is reported as unavailable, and so is a file connection synced from another iPhone or iPad; the connection never opens an empty database, or a file of the same name on this device, in its place. +## IAM sign-in + +Short-lived tokens replace the password for [AWS IAM](/connections/aws-iam) on Amazon RDS and Aurora (MySQL, MariaDB, PostgreSQL) and ElastiCache (Redis), and for [Google Cloud IAM](/connections/cloud-sql-proxy#iam-sign-in-without-the-proxy) on Cloud SQL (MySQL, PostgreSQL). Pick the method under **Authentication** in the connection's form, and the **Password** field goes away. Each connect signs a fresh token and never saves it. + +The methods match the Mac's, but two of them read files that only the Mac has: + +| Method | What this device needs | +| --- | --- | +| **AWS IAM (Access Key)** | The access key in the form. With **Sync Passwords** on, a key saved on the Mac comes over | +| **AWS IAM (Profile)** | A key under **Access Key for This Device**, since the profile is read from files on the Mac | +| **AWS IAM (SSO)** | **Start URL** and **SSO Region** under **IAM Identity Center**, then **Sign In with IAM Identity Center** and an **Account** and **Role** | +| **Google Cloud IAM (Service Account)** | The JSON key: tap **Service Account Key** to paste it or choose the file. A key pasted on the Mac comes over with **Sync Passwords**; a key file on the Mac does not | +| **Google Cloud IAM (Application Default)** | A service account key under **Key for This Device**, since the `gcloud` credentials are files on the Mac | + +A key for this device and the IAM Identity Center settings stay on this device. They never sync, whatever **Sync Passwords** says, and the connection on the Mac does not change. Opening a connection that still needs one says which, with **Edit Connection** to add it. + + + AWS Profile Is on the Mac error with Edit Connection and Retry, beside the connection form's Authentication section set to AWS IAM (Profile) with an empty Access Key for This Device section + AWS Profile Is on the Mac error with Edit Connection and Retry, beside the connection form's Authentication section set to AWS IAM (Profile) with an empty Access Key for This Device section + + +**Sign In with IAM Identity Center** shows a code and opens the browser; confirm the code there. When that sign-in expires, opening the connection offers to sign in again. + +A token needs an encrypted connection. A MySQL, MariaDB or PostgreSQL connection with **SSL Mode** on **Disabled** connects with **Required**, and a MySQL server that offers no TLS is refused before the token is sent. A Redis connection with SSL off fails until you turn SSL on. + ## What works An open connection fills the screen and carries four sections: **Tables**, **Query**, **History**, **Info**. They sit in a tab bar on iPhone and in a sidebar on iPad.