feat: assume role provider credentials (#28)

* feat: assume role provider credentials

This commit updates the awsutil dependency to its latest version, which
supports the capability of using dynamic credentials. The storage service
was refactored to make static credentials optional. The credentials pkg
was refactored to support several attribute fields used for the assume
role provider. The host service still enforces the use of static
credentials.

testing/testdata/storage/iam.tf

@@ -0,0 +1,240 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+resource "aws_iam_role" "valid" {
+  name = "${random_id.prefix.dec}-valid"
+  tags = local.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS: data.aws_caller_identity.current.user_id
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_policy" "valid" {
+  name = "${random_id.prefix.dec}-valid"
+  tags = local.tags
+
+  policy = <<EOT
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObject",
+        "s3:GetObjectAttributes"
+      ],
+      "Effect": "Allow",
+      "Resource": "${aws_s3_bucket.test.arn}*"
+    }
+  ]
+
+}
+EOT
+}
+
+resource "aws_iam_role_policy_attachment" "valid" {
+  role       = aws_iam_role.valid.name
+  policy_arn = aws_iam_policy.valid.arn
+}
+
+resource "aws_iam_role" "missing_put_obj" {
+  name = "${random_id.prefix.dec}-missing-put-obj"
+  tags = local.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS: data.aws_caller_identity.current.user_id
+        }
+      },
+    ]
+  })
+}
+
+
+resource "aws_iam_policy" "missing_put_obj" {
+  name = "${random_id.prefix.dec}-missing-put-obj"
+  tags = local.tags
+
+  policy = <<EOT
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "s3:GetObject",
+        "s3:GetObjectAttributes"
+      ],
+      "Effect": "Allow",
+      "Resource": "${aws_s3_bucket.test.arn}*"
+    }
+  ]
+
+}
+EOT
+}
+
+resource "aws_iam_role_policy_attachment" "missing_put_obj" {
+  role       = aws_iam_role.missing_put_obj.name
+  policy_arn = aws_iam_policy.missing_put_obj.arn
+}
+
+resource "aws_iam_role" "missing_get_obj" {
+  name = "${random_id.prefix.dec}-missing-get-obj"
+  tags = local.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Sid    = ""
+        Principal = {
+          AWS: data.aws_caller_identity.current.user_id
+        }
+      },
+    ]
+  })
+}
+
+resource "aws_iam_policy" "missing_get_obj" {
+  name = "${random_id.prefix.dec}-missing-get-obj"
+  tags = local.tags
+
+  policy = <<EOT
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "s3:PutObject",
+        "s3:GetObjectAttributes"
+      ],
+      "Effect": "Allow",
+      "Resource": "${aws_s3_bucket.test.arn}*"
+    }
+  ]
+
+}
+EOT
+}
+
+resource "aws_iam_role_policy_attachment" "missing_get_obj" {
+  role       = aws_iam_role.missing_get_obj.name
+  policy_arn = aws_iam_policy.missing_get_obj.arn
+}
+
+# Static Credential Testing
+resource "random_id" "user_name" {
+  count       = var.iam_user_count
+  prefix      = random_id.prefix.dec
+  byte_length = 4
+}
+
+resource "aws_iam_user" "test" {
+  count         = var.iam_user_count
+  name          = random_id.user_name[count.index].dec
+  force_destroy = true
+  tags          = local.tags
+}
+
+resource "aws_iam_access_key" "test" {
+  count = var.iam_user_count
+  user  = aws_iam_user.test[count.index].name
+}
+
+resource "aws_iam_user_policy_attachment" "test_s3" {
+  count      = var.iam_user_count
+  user       = aws_iam_user.test[count.index].name
+  policy_arn = aws_iam_policy.valid.arn
+}
+
+resource "aws_iam_policy" "credentials" {
+  count = var.iam_user_count
+  name  = aws_iam_user.test[count.index].name
+  tags  = local.tags
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "iam:DeleteAccessKey",
+        "iam:GetUser",
+        "iam:CreateAccessKey"
+      ],
+      "Effect": "Allow",
+      "Resource": "${aws_iam_user.test[count.index].arn}"
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_iam_user_policy_attachment" "test_credentials" {
+  count      = var.iam_user_count
+  user       = aws_iam_user.test[count.index].name
+  policy_arn = aws_iam_policy.credentials[count.index].arn
+}
+
+# Edge case for missing GetObject permission
+
+resource "random_id" "missing_get_obj" {
+  prefix      = random_id.prefix.dec
+  byte_length = 4
+}
+
+resource "aws_iam_user" "missing_get_obj" {
+  name          = random_id.missing_get_obj.dec
+  force_destroy = true
+  tags          = local.tags
+}
+
+resource "aws_iam_access_key" "missing_get_obj" {
+  user  = aws_iam_user.missing_get_obj.name
+}
+
+resource "aws_iam_user_policy_attachment" "missing_get_obj" {
+  user       = aws_iam_user.missing_get_obj.name
+  policy_arn = aws_iam_policy.missing_get_obj.arn
+}
+
+# Edge case for missing PutObject permission
+
+resource "random_id" "missing_put_obj" {
+  prefix      = random_id.prefix.dec
+  byte_length = 4
+}
+
+resource "aws_iam_user" "missing_put_obj" {
+  name          = random_id.missing_put_obj.dec
+  force_destroy = true
+  tags          = local.tags
+}
+
+resource "aws_iam_access_key" "missing_put_obj" {
+  user  = aws_iam_user.missing_put_obj.name
+}
+
+resource "aws_iam_user_policy_attachment" "missing_put_obj" {
+  user       = aws_iam_user.missing_put_obj.name
+  policy_arn = aws_iam_policy.missing_put_obj.arn
+}

testing/testdata/storage/main.tf

@@ -0,0 +1,11 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 3.0"
+    }
+  }
+}

testing/testdata/storage/output.tf

@@ -0,0 +1,56 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+output "bucket_name" {
+  value = aws_s3_bucket.test.id
+}
+
+output "valid_policy_arn" {
+    value = aws_iam_role.valid.arn
+}
+
+output "missing_put_obj_policy_arn" {
+    value = aws_iam_role.missing_put_obj.arn
+}
+
+output "missing_put_get_policy_arn" {
+    value = aws_iam_role.missing_get_obj.arn
+}
+
+output "iam_user_names" {
+  value = aws_iam_user.test.*.name
+}
+
+output "iam_user_arns" {
+  value = aws_iam_user.test.*.arn
+}
+
+output "iam_access_key_ids" {
+  value     = aws_iam_access_key.test.*.id
+  sensitive = true
+}
+
+output "iam_secret_access_keys" {
+  value     = aws_iam_access_key.test.*.secret
+  sensitive = true
+}
+
+output "iam_access_key_missing_put_obj" {
+  value     = aws_iam_access_key.missing_put_obj.id
+  sensitive = true
+}
+
+output "iam_secret_access_key_missing_put_obj" {
+  value     = aws_iam_access_key.missing_put_obj.secret
+  sensitive = true
+}
+
+output "iam_access_key_missing_get_obj" {
+  value     = aws_iam_access_key.missing_get_obj.id
+  sensitive = true
+}
+
+output "iam_secret_access_key_missing_get_obj" {
+  value     = aws_iam_access_key.missing_get_obj.secret
+  sensitive = true
+}

testing/testdata/storage/s3.tf

@@ -0,0 +1,9 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+resource "aws_s3_bucket" "test" {
+  bucket        = random_id.prefix.dec
+  force_destroy = true
+  acl           = "private"
+  tags          = local.tags
+}

testing/testdata/storage/test_object_data

@@ -0,0 +1 @@
+HELLO_WORLD!

testing/testdata/storage/variable.tf

@@ -0,0 +1,20 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+data "aws_caller_identity" "current" {}
+
+resource "random_id" "prefix" {
+  prefix      = "storage-e2e-test"
+  byte_length = 4
+}
+
+variable "iam_user_count" {
+  default = 6
+}
+
+locals {
+  tags = {
+    user_id = split(":", data.aws_caller_identity.current.user_id)[1]
+    repo    = "boundary-plugin-aws" 
+  }
+}