feat(infra): Add IAM support for Redis

[justin-tahara]

Description

[Provide a brief description of the changes in this PR]
Adding in IAM support for Redis to match Postgresql

How Has This Been Tested?

[Describe the tests you ran to verify your changes]
Still working on testing this.

Backporting (check the box to trigger backport action)

Note: You have to check that the action passes, otherwise resolve the conflicts manually and tag the patches.

• This PR should be backported (make sure to check that the backport attempt succeeds)
• [Optional] Override Linear Check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
internal-search	Ready	Preview	Comment	Aug 26, 2025 9:27pm

[greptile-apps]

Greptile Summary

This PR introduces IAM authentication support for Redis ElastiCache to complement the existing PostgreSQL IAM authentication pattern in the codebase. The implementation adds a new configuration flag USE_REDIS_IAM_AUTH that allows Redis connections to use AWS IAM roles instead of password-based authentication.

The changes span four key areas:

1. Configuration: Adds the USE_REDIS_IAM_AUTH environment variable flag in app_configs.py
2. Redis Connection Handling: Updates redis_pool.py to create IAM-aware connection pools that disable password auth and enforce SSL when IAM is enabled
3. IAM Authentication Module: Introduces iam_auth.py containing functions for token generation, SSL configuration, and credential management
4. Celery Integration: Modifies base.py to exclude passwords from broker URLs when IAM authentication is active

The implementation follows the same architectural pattern as the existing PostgreSQL IAM authentication (USE_IAM_AUTH), maintaining consistency across the codebase. When USE_REDIS_IAM_AUTH is enabled, Redis connections are configured to use SSL and IAM credentials from AWS, while traditional password authentication is bypassed. This enables secure integration with AWS ElastiCache clusters that are configured for IAM authentication, eliminating the need for hardcoded Redis passwords and leveraging AWS IAM policies for access control.

Confidence score: 1/5

• This PR has critical implementation flaws that will cause authentication failures in production
• Score reflects fundamental issues with the IAM token generation logic that doesn't align with AWS ElastiCache IAM authentication mechanisms
• Pay close attention to backend/onyx/redis/iam_auth.py - the core authentication logic needs complete revision as it attempts to use cluster names as tokens rather than generating proper IAM auth tokens

_{4 files reviewed, 6 comments}

_{Edit Code Review Bot Settings | Greptile}

[cubic-dev-ai]

6 issues found across 4 files

_{React with 👍 or 👎 to teach cubic. You can also tag @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

[cubic-dev-ai]

IAM auth requires an AUTH token (SigV4) and username; setting password=None means no authentication will be performed, causing connection failures with ElastiCache Redis IAM.

Prompt for AI agents

Address the following comment on backend/onyx/redis/redis_pool.py at line 209:

<comment>IAM auth requires an AUTH token (SigV4) and username; setting password=None means no authentication will be performed, causing connection failures with ElastiCache Redis IAM.</comment>

<file context>
@@ -192,6 +196,28 @@ def create_pool(
 
         # Using ConnectionPool is not well documented.
         # Useful examples: https://github.com/redis/redis-py/issues/780
+
+        # Handle IAM authentication
+        if USE_REDIS_IAM_AUTH:
+            # For IAM authentication, we don&#39;t use password
+            # and ensure SSL is enabled
+            ssl_context = create_redis_ssl_context_if_iam()
</file context>

[justin-tahara]

@greptileai

[greptile-apps]

Greptile Summary

This PR adds IAM authentication support for Redis ElastiCache to match the existing PostgreSQL IAM authentication capabilities in the codebase. The changes introduce a new configuration variable USE_REDIS_IAM_AUTH that enables IAM-based authentication for Redis connections.

The implementation adds four key components:

1. Configuration: A new USE_REDIS_IAM_AUTH environment variable in app_configs.py that follows the same pattern as the existing USE_IAM_AUTH for PostgreSQL

2. IAM Authentication Module: A new iam_auth.py file in the Redis directory that provides functions for configuring IAM authentication parameters and creating SSL contexts

3. Celery Integration: Updates to the Celery broker configuration to conditionally exclude password authentication when IAM auth is enabled

4. Redis Pool Integration: Modifications to both synchronous and asynchronous Redis connection creation to support IAM authentication by removing password-based auth and enabling SSL

The approach mirrors the existing PostgreSQL IAM authentication pattern by creating separate configuration paths for IAM versus traditional authentication methods. When IAM authentication is enabled, the system removes password-based authentication and ensures SSL is properly configured for secure connections to AWS ElastiCache.

Confidence score: 1/5

• This PR is not safe to merge and will cause Redis connection failures in production
• Score reflects fundamental flaws in IAM authentication implementation - the code only removes passwords and enables SSL but doesn't implement actual AWS Signature V4 authentication tokens required by ElastiCache IAM
• Pay close attention to backend/onyx/redis/iam_auth.py and backend/onyx/redis/redis_pool.py as they contain incomplete IAM authentication logic that will fail silently

_{4 files reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}