Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow aws checks to use existing credentials without assumerole #786

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

jesusfcr
Copy link
Contributor

@jesusfcr jesusfcr commented Jan 16, 2025

Motivation

The checks that need access to an AWS Account uses the vulcan assume role endpoint for request temporary credentials from an http server.
The implementation of that server is not open source so it limits the usage of those checks.
The code if scattered and duplicated for each check.

Description

This pr allows the checks to access AWS Accounts with standard methods:

  1. If VULCAN_ASSUME_ROLE_ENDPOINT is set use the endpoint to retrieve the credentials.
  2. Otherwise obtain the current credentials from the system and if ROLE_NAME exists assume that role.

This method allows to execute the checks without requiring the vulcan-assume-role service using the aws provided credentials

  • Running in a pod with the required aws credentials
  • Running a check in lava passing the aws credentials

TODO / DOUBT / WIP

The current solution unifies the code required to get aws.Config.

  • The helper functions are in an internal package. Those could be moved to the aws-check-sdk. Although adding an internal pkg could be a good alternative for sharing code without requiring to upgrade the sdk.
  • It reports INCONCLUSIVE if the check can not access.
  • The helper functions could support a list of roles to assume.

@jesusfcr jesusfcr marked this pull request as draft January 17, 2025 06:47
@jesusfcr jesusfcr force-pushed the improve-aws branch 3 times, most recently from e9498f3 to 0f252df Compare January 20, 2025 11:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant