Redshift database plugin support

[briankassouf]

This adds a redshift-database-plugin that uses the postgres plugin but lowercases the usernames. Fixes #4052

[malnick]

Going to test this against Redshift, thanks @briankassouf!

[kalafut]

LGTM

[malnick]

Just as a note. In testing, I had to make modifications for the create statement:

./vault write database/config/redshift-db-test \                                                                                                                                                                                                                                        
      plugin_name="redshift-database-plugin" \
      allowed_roles=["my-role", "CAPS-my-role"] \
      connection_url="postgresql://{{username}}:{{password}}@redshift-cluster-1.cnbllhv6qngo.us-east-2.redshift.amazonaws.com:5439/dev" \
      username="vault" \
      password="asdASD123!"
  
  # test with lowercase role name
  vault write database/roles/my-role \
      db_name=redshift-db-test \
      creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
            GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
      default_ttl="1h" \
      max_ttl="24h"
  
  # test with uppercase role name
  vault write database/roles/CAPS-my-role \
      db_name=redshift-db-test \
      creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
            GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
      default_ttl="1h" \
      max_ttl="24h"

This fixes the upper case issues we were seeing before. However, revocation still doesn't work but I'll be working with the redshift team at AWS to get a revocation statement that fixes this.

[malnick]

I was able to get an e2e test for creating a role (one with and one without caps letters), test the role exists, and then revoke leases without error:

  #./vault secrets enable database                                                                                                                                                                                                                                                        
  export VAULT_ADDR=http://localhost:8200
  
  ./vault secrets enable database || true
  
  ./vault write database/config/redshift-db-test \
      plugin_name="redshift-database-plugin" \
      allowed_roles="my-role, CAPS-my-role" \
      connection_url="postgresql://{{username}}:{{password}}@redshift-cluster-2.cnbllhv6qngo.us-east-2.redshift.amazonaws.com:5439/dev" \
      username="vault" \
      password="asdASD123!"
  
  # test with lowercase role name
  # to revoke we need pg_user not pg_role
  vault write database/roles/my-role \
      db_name=redshift-db-test \
      creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
            GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
      revocation_statements="REVOKE ALL ON SCHEMA public FROM \"{{name}}\";"
      default_ttl="1h" \
      max_ttl="24h"
  
  ./vault read database/creds/my-role
  
  # test with uppercase role name
  vault write database/roles/CAPS-my-role \
      db_name=redshift-db-test \
      creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
            GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
      revocation_statements="REVOKE ALL ON SCHEMA public FROM \"{{name}}\";"
      default_ttl="1h" \
      max_ttl="24h"
  
  ./vault read database/creds/CAPS-my-role
  
  # test revoke
  ./vault lease revoke $(./vault read database/creds/my-role | grep lease_id | cut -d" " -f2- | tr -d '[:space:]')
  ./vault lease revoke $(./vault read database/creds/CAPS-my-role | grep lease_id | cut -d" " -f2- | tr -d '[:space:]')

I haven't poked at the database directly to ensure it does what I think it does, but Vault is no longer complaining about the lease not being revoked.

[malnick]

Closing in favor of #8144