求StackExchange.Redis连接ElastiCache IAM认证的C#示例代码

代码示例 #

先安装所需NuGet包：

Install-Package StackExchange.Redis
Install-Package AWSSDK.Core

以下是完整的连接实现，包含IAM签名令牌生成逻辑：

using System;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Amazon;
using Amazon.Runtime;
using StackExchange.Redis;

public class ElastiCacheIamConnectionHelper
{
    // 替换为你的集群配置信息
    private const string ClusterEndpoint = "your-cluster-endpoint.cache.amazonaws.com:6379";
    private const string ElastiCacheIamUserName = "your-iam-auth-elasticache-user";
    private static readonly RegionEndpoint ClusterRegion = RegionEndpoint.USEast1;

    public static async Task<IConnectionMultiplexer> GetRedisConnectionAsync()
    {
        var authToken = await GenerateIamAuthTokenAsync();
        
        var config = ConfigurationOptions.Parse(ClusterEndpoint);
        config.User = ElastiCacheIamUserName;
        config.Password = authToken;
        config.Ssl = true; // IAM认证强制要求SSL
        config.AbortOnConnectFail = false;

        return await ConnectionMultiplexer.ConnectAsync(config);
    }

    private static async Task<string> GenerateIamAuthTokenAsync()
    {
        var credentials = FallbackCredentialsFactory.GetCredentials();
        var awsCreds = await credentials.GetCredentialsAsync();
        
        var utcNow = DateTime.UtcNow;
        var dateStamp = utcNow.ToString("yyyyMMdd");
        var amzDate = utcNow.ToString("yyyyMMddTHHmmssZ");
        var region = ClusterRegion.SystemName;
        var service = "elasticache";

        // 构建规范请求
        var canonicalUri = "/";
        var canonicalQueryString = "";
        var canonicalHeaders = $"host:{ClusterEndpoint.Split(':')[0]}\n";
        var signedHeaders = "host";
        var payloadHash = HashString("");

        var canonicalRequest = $"GET\n{canonicalUri}\n{canonicalQueryString}\n{canonicalHeaders}\n{signedHeaders}\n{payloadHash}";

        // 构建待签名字符串
        var credentialScope = $"{dateStamp}/{region}/{service}/aws4_request";
        var stringToSign = $"AWS4-HMAC-SHA256\n{amzDate}\n{credentialScope}\n{HashString(canonicalRequest)}";

        // 生成签名密钥
        var signingKey = GetSignatureKey(awsCreds.SecretKey, dateStamp, region, service);

        // 计算签名
        var signature = ComputeHmacSha256(stringToSign, signingKey);

        // 生成最终认证令牌
        return $"AWS4-HMAC-SHA256 Credential={awsCreds.AccessKey}/{credentialScope},SignedHeaders={signedHeaders},Signature={signature}";
    }

    private static byte[] GetSignatureKey(string secretKey, string dateStamp, string regionName, string serviceName)
    {
        var kSecret = Encoding.UTF8.GetBytes($"AWS4{secretKey}");
        var kDate = ComputeHmacSha256Bytes(dateStamp, kSecret);
        var kRegion = ComputeHmacSha256Bytes(regionName, kDate);
        var kService = ComputeHmacSha256Bytes(serviceName, kRegion);
        return ComputeHmacSha256Bytes("aws4_request", kService);
    }

    private static string HashString(string input)
    {
        using var sha256 = SHA256.Create();
        var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(input));
        return BitConverter.ToString(bytes).Replace("-", "").ToLowerInvariant();
    }

    private static string ComputeHmacSha256(string input, byte[] key)
    {
        using var hmac = new HMACSHA256(key);
        var bytes = hmac.ComputeHash(Encoding.UTF8.GetBytes(input));
        return BitConverter.ToString(bytes).Replace("-", "").ToLowerInvariant();
    }

    private static byte[] ComputeHmacSha256Bytes(string input, byte[] key)
    {
        using var hmac = new HMACSHA256(key);
        return hmac.ComputeHash(Encoding.UTF8.GetBytes(input));
    }
}

针对wrongpass:invalid-username-password错误的排查要点 #

• ElastiCache用户配置验证：确认你创建的ElastiCache用户为IAM认证模式，且关联的IAM实体（用户/角色）已附加包含elasticache:Connect权限的策略，策略资源需覆盖目标集群ARN。
• 用户名匹配检查：代码中ElastiCacheIamUserName必须与ElastiCache控制台创建的IAM认证用户名完全一致，注意大小写敏感。
• 令牌生成正确性：
  • 确保生成令牌使用的IAM凭证拥有目标集群的访问权限，避免使用无权限的本地凭证或临时凭证过期。
  • 验证集群区域与代码中ClusterRegion一致，签名区域不匹配会导致令牌无效。
  • 确认host头使用集群端点的域名（不含端口），比如your-cluster-endpoint.cache.amazonaws.com。
• SSL强制要求：IAM认证必须启用SSL连接，代码中必须设置config.Ssl = true，否则连接会被拒绝。
• 集群版本确认：确保ElastiCache集群为Redis 7.0及以上版本，低版本不支持IAM认证功能。

内容的提问来源于stack exchange，提问作者Manpreet Juneja