feat(worker): add AWS IAM flags to worker command for RDS IAM auth

cmd/worker.go

@@ -10,6 +10,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 
+	"github.com/formancehq/go-libs/v5/pkg/cloud/aws/iam"
 	"github.com/formancehq/go-libs/v5/pkg/fx/storagefx"
 	"github.com/formancehq/go-libs/v5/pkg/observe/metrics"
 	"github.com/formancehq/go-libs/v5/pkg/observe/traces"
@@ -132,6 +133,7 @@ func NewWorkerCommand() *cobra.Command {
 	connect.AddFlags(cmd.Flags())
 	metrics.AddFlags(cmd.Flags())
 	traces.AddFlags(cmd.Flags())
+	iam.AddFlags(cmd.Flags())
 
 	return cmd
 }

cmd/worker_test.go

@@ -0,0 +1,106 @@
+package cmd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/formancehq/go-libs/v5/pkg/cloud/aws/iam"
+	"github.com/formancehq/go-libs/v5/pkg/storage/bun/connect"
+)
+
+// TestWorkerCommandHasAWSIAMFlags verifies that the worker command registers
+// all required AWS IAM flags, so that users running the standalone worker binary
+// (e.g. on AWS ECS Fargate) can configure RDS IAM auth for the primary store
+// via CLI flags, not just via environment variables.
+func TestWorkerCommandHasAWSIAMFlags(t *testing.T) {
+	t.Parallel()
+
+	cmd := NewWorkerCommand()
+	flags := cmd.Flags()
+
+	// These flags come from connect.AddFlags and enable IAM on the primary store
+	t.Run("postgres-aws-enable-iam flag is registered", func(t *testing.T) {
+		t.Parallel()
+		f := flags.Lookup(connect.PostgresAWSEnableIAMFlag)
+		require.NotNil(t, f, "--postgres-aws-enable-iam flag must be registered on the worker command")
+		assert.Equal(t, "false", f.DefValue)
+	})
+
+	// These flags come from iam.AddFlags (added to fix issue #1556).
+	// Note: --aws-role-arn is registered by iam.AddFlags but is not currently
+	// consumed by iam.LoadOptionFromFlags in go-libs; it is included here to
+	// confirm registration parity with serve and to catch any future removal.
+	t.Run("aws-region flag is registered", func(t *testing.T) {
+		t.Parallel()
+		f := flags.Lookup(iam.AWSRegionFlag)
+		require.NotNil(t, f, "--aws-region flag must be registered on the worker command")
+	})
+
+	t.Run("aws-access-key-id flag is registered", func(t *testing.T) {
+		t.Parallel()
+		f := flags.Lookup(iam.AWSAccessKeyIDFlag)
+		require.NotNil(t, f, "--aws-access-key-id flag must be registered on the worker command")
+	})
+
+	t.Run("aws-secret-access-key flag is registered", func(t *testing.T) {
+		t.Parallel()
+		f := flags.Lookup(iam.AWSSecretAccessKeyFlag)
+		require.NotNil(t, f, "--aws-secret-access-key flag must be registered on the worker command")
+	})
+
+	t.Run("aws-session-token flag is registered", func(t *testing.T) {
+		t.Parallel()
+		f := flags.Lookup(iam.AWSSessionTokenFlag)
+		require.NotNil(t, f, "--aws-session-token flag must be registered on the worker command")
+	})
+
+	t.Run("aws-profile flag is registered", func(t *testing.T) {
+		t.Parallel()
+		f := flags.Lookup(iam.AWSProfileFlag)
+		require.NotNil(t, f, "--aws-profile flag must be registered on the worker command")
+	})
+
+	// Registered by iam.AddFlags but not consumed by iam.LoadOptionFromFlags;
+	// included to confirm registration parity and catch accidental removal.
+	t.Run("aws-role-arn flag is registered", func(t *testing.T) {
+		t.Parallel()
+		f := flags.Lookup(iam.AWSRoleArnFlag)
+		require.NotNil(t, f, "--aws-role-arn flag must be registered on the worker command")
+	})
+}
+
+// TestServeCommandHasAWSIAMFlags verifies the serve command also exposes
+// the same AWS IAM flags for parity (regression guard).
+func TestServeCommandHasAWSIAMFlags(t *testing.T) {
+	t.Parallel()
+
+	cmd := NewServeCommand()
+	flags := cmd.Flags()
+
+	// Verify the IAM-enable flag defaults to false on serve as well
+	f := flags.Lookup(connect.PostgresAWSEnableIAMFlag)
+	require.NotNil(t, f, "--postgres-aws-enable-iam flag must be registered on the serve command")
+	assert.Equal(t, "false", f.DefValue)
+
+	// Note: --aws-role-arn is registered by iam.AddFlags but not consumed by
+	// iam.LoadOptionFromFlags in the current go-libs version.
+	iamFlags := []string{
+		connect.PostgresAWSEnableIAMFlag,
+		iam.AWSRegionFlag,
+		iam.AWSAccessKeyIDFlag,
+		iam.AWSSecretAccessKeyFlag,
+		iam.AWSSessionTokenFlag,
+		iam.AWSProfileFlag,
+		iam.AWSRoleArnFlag,
+	}
+
+	for _, flagName := range iamFlags {
+		t.Run(flagName+" is registered on serve", func(t *testing.T) {
+			t.Parallel()
+			f := flags.Lookup(flagName)
+			require.NotNil(t, f, "--%s flag must be registered on the serve command", flagName)
+		})
+	}
+}