This section shows you how to connect to Amazon Keyspaces by using a Go Cassandra client driver. To provide users and applications with credentials for programmatic access to Amazon Keyspaces resources, you can do either of the following:
-
Create service-specific credentials that are associated with a specific AWS Identity and Access Management (IAM) user.
-
For enhanced security, we recommend to create IAM access keys for IAM principals that are used across all AWS services. The Amazon Keyspaces SigV4 authentication plugin for Cassandra client drivers enables you to authenticate calls to Amazon Keyspaces using IAM access keys instead of user name and password. For more information, see Create and configure AWS credentials for Amazon Keyspaces.
Topics
Before you begin
You need to complete the following task before you can start.
Amazon Keyspaces requires the use of Transport Layer Security (TLS) to help secure connections with clients. To connect to Amazon Keyspaces using TLS, you need to download an Amazon digital certificate and configure the Go driver to use TLS.
Download the Starfield digital certificate using the following command and save
sf-class2-root.crt locally or in your home directory.
curl https://certs.secureserver.net/repository/sf-class2-root.crt -ONote
You can also use the Amazon digital certificate to connect to Amazon Keyspaces and can continue to do so if your client is connecting to Amazon Keyspaces successfully. The Starfield certificate provides additional backwards compatibility for clients using older certificate authorities.
curl https://certs.secureserver.net/repository/sf-class2-root.crt -O
Connect to Amazon Keyspaces using the
Gocql driver for Apache Cassandra and service-specific credentials
-
Create a directory for your application.
mkdir ./gocqlexample -
Navigate to the new directory.
cd gocqlexample -
Create a file for your application.
touch cqlapp.go -
Download the Go driver.
go get github.com/gocql/gocql -
Add the following sample code to the cqlapp.go file.
package main import ( "fmt" "github.com/gocql/gocql" "log" ) func main() { // add the Amazon Keyspaces service endpoint cluster := gocql.NewCluster("cassandra.us-east-2.amazonaws.com") cluster.Port=9142 // add your service specific credentials cluster.Authenticator = gocql.PasswordAuthenticator{ Username: "ServiceUserName", Password: "ServicePassword"} // provide the path to the sf-class2-root.crt cluster.SslOpts = &gocql.SslOptions{ CaPath: "path_to_file/sf-class2-root.crt", EnableHostVerification: false, } // Override default Consistency to LocalQuorum cluster.Consistency = gocql.LocalQuorum cluster.DisableInitialHostLookup = false session, err := cluster.CreateSession() if err != nil { fmt.Println("err>", err) } defer session.Close() // run a sample query from the system keyspace var text string iter := session.Query("SELECT keyspace_name FROM system_schema.tables;").Iter() for iter.Scan(&text) { fmt.Println("keyspace_name:", text) } if err := iter.Close(); err != nil { log.Fatal(err) } session.Close() }Usage notes:
Replace
"with the path to the certificate saved in the first step.path_to_file/sf-class2-root.crt"Ensure that the
ServiceUserNameandServicePasswordmatch the user name and password you obtained when you generated the service-specific credentials by following the steps to Create service-specific credentials for programmatic access to Amazon Keyspaces.For a list of available endpoints, see Service endpoints for Amazon Keyspaces.
Build the program.
go build cqlapp.goRun the program.
./cqlapp
Connect to Amazon Keyspaces using the
Go driver for Apache Cassandra and the SigV4 authentication plugin
The following code sample shows how to use the SigV4 authentication plugin for the open-source Go driver to access Amazon Keyspaces (for Apache Cassandra).
If you haven't already done so, create credentials for your IAM principal following the steps at Create and configure AWS credentials for Amazon Keyspaces. If an application is running on Lambda or an Amazon EC2 instance, your application is automatically using the credentials of the instance. To run this tutorial locally, you can store the credentials as local environment variables.
Add the Go SigV4 authentication plugin to your application from the GitHub
repository
$ go mod init
$ go get github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-pluginIn this code example, the Amazon Keyspaces endpoint is represented by the Cluster
class. It uses the AwsAuthenticator for the authenticator property of the
cluster to obtain credentials.
package main
import (
"fmt"
"github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin/sigv4"
"github.com/gocql/gocql"
"log"
)
func main() {
// configuring the cluster options
cluster := gocql.NewCluster("cassandra.us-west-2.amazonaws.com")
cluster.Port=9142
// the authenticator uses the default credential chain to find AWS credentials
cluster.Authenticator = sigv4.NewAwsAuthenticator()
cluster.SslOpts = &gocql.SslOptions{
CaPath: "path_to_file/sf-class2-root.crt",
EnableHostVerification: false,
}
cluster.Consistency = gocql.LocalQuorum
cluster.DisableInitialHostLookup = false
session, err := cluster.CreateSession()
if err != nil {
fmt.Println("err>", err)
return
}
defer session.Close()
// doing the query
var text string
iter := session.Query("SELECT keyspace_name FROM system_schema.tables;").Iter()
for iter.Scan(&text) {
fmt.Println("keyspace_name:", text)
}
if err := iter.Close(); err != nil {
log.Fatal(err)
}
}Usage notes:
Replace
"with the path to the certificate saved in the first step.path_to_file/sf-class2-root.crt"-
For this example to run locally, you need to define the following variables as environment variables:
AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_DEFAULT_REGION
To store access keys outside of code, see best practices at Store access keys for programmatic access.
For a list of available endpoints, see Service endpoints for Amazon Keyspaces.
