November 2025 Summaries

Passwords in modern infrastructure are often problematic due to their complexity in management and vulnerability to leaks, prompting SingleStore to pursue a passwordless future to enhance security and simplicity. Initially, the company introduced singlestore-auth-helper to allow human users to connect to databases without passwords, improving access, auditability, and reducing credential sprawl. This initiative has now been extended to servers and applications with the launch of singlestore-auth-iam, which enables passwordless authentication by integrating with cloud provider Identity and Access Management (IAM) systems like AWS IAM, Azure AD, or GCP IAM. This approach leverages short-lived, automatically rotated credentials, eliminating the need for static database passwords and decreasing risks associated with credential leakage, operational management of secrets, and compliance complexities. By focusing solely on authentication, singlestore-auth-iam ensures secure access without handling passwords, while authorization is maintained through SingleStore's role-based permissions. The unified approach offered by singlestore-auth-helper and singlestore-auth-iam facilitates secure, auditable authentication for developers and applications, aligning with the Zero Trust principle and simplifying the security of data infrastructure.

SingleStore’s private-preview Passwordless Authentication for Service Accounts enables applications to use AWS IAM roles, GCP service accounts, or Azure managed identities to obtain provider-issued tokens that are exchanged for short-lived JWTs, eliminating the need to store passwords or long-lived secrets when accessing SingleStore databases and Portal APIs. The approach is intended to improve security through reduced credential exposure, short-lived access, auditable cloud role identifiers, and customer-controlled database role mappings, while also reducing secret rotation, distribution, and credential-expiration issues. Workloads obtain a verifiable cloud identity token at runtime, submit it through a SingleStore library or REST interface, and receive a JWT that SingleStore validates against configured database users, roles, and API permissions. Prerequisites include a supported cloud identity, connectivity to SingleStore authentication endpoints in AWS us-east-1, use of the IAM authentication library or API, and corresponding identity mappings in SingleStore. Pilot success is measured by password-free connections, reliable JWT renewal, visible audit identities, effective revocation, fewer operational incidents, and no expected database performance impact under load.