threshold-plugin-aws

0 Fork 0

Files

T

Hugo 2568eb83b8 fix(storage): Storage Assume Role Support

This commit introduces fixes to enable operators to use AWS dynamic
credentials on the storage side of this plugin, namely validation,
improved credential lifecycle management to allow for storage buckets to
be updated from static to dynamic credentials and vice versa, and a new
way to determine credential types.

It also introduces new tests for dynamic credential usage for the
various functions.

2023-09-21 18:45:35 +01:00

attributes_test.go

feat: assume role provider credentials (#28 )

2023-07-18 16:33:24 -07:00

attributes.go

feat: assume role provider credentials (#28 )

2023-07-18 16:33:24 -07:00

const.go

[COMPLIANCE] Add Copyright and License Headers (#26 )

2023-06-05 09:52:48 -07:00

plugin_test.go

fix(storage): Storage Assume Role Support

2023-09-21 18:45:35 +01:00

plugin.go

fix(storage): Storage Assume Role Support

2023-09-21 18:45:35 +01:00

README.md

feat: assume role provider credentials (#28 )

2023-07-18 16:33:24 -07:00

state_test.go

fix(storage): Storage Assume Role Support

2023-09-21 18:45:35 +01:00

state.go

refactor: switch from awsutil to awsutilv2

2023-08-08 23:14:11 -07:00

testing.go

fix(storage): Storage Assume Role Support

2023-09-21 18:45:35 +01:00

README.md

Getting Started

To create a storage bucket (using default scope created by boundary dev):

boundary storage-buckets create \
 -scope-id p_1234567890 \
 -name "Example Plugin-Based Storage Bucket" \
 -description "Description for plugin-based storage bucket" \
 -plugin-name aws \
 -bucket-name="session_recording_storage" \
 -bucket-prefix="foo/bar/zoo" \
 -worker-filter ‘“aws-access” in “/tags/type”’ \
 -attr region=REGION \
 -attr endpoint_url=0.0.0.0 \
 -secret access_key_id='KEY' \
 -secret secret_access_key='SECRET'

Required IAM Privileges

The following IAM privileges, at the very least, are required to be attached to a configured IAM user for this provider:

Example policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:GetObjectAttributes"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::session_recording_storage/foo/bar/zoo/*"
    }
  ]
}

iam:GetUser, iam:CreateAccessKey, and iam:DeleteAccessKey, configured to the IAM user to allow static credential rotation. Example policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "iam:DeleteAccessKey",
        "iam:GetUser",
        "iam:CreateAccessKey"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:iam::123456789012:user/JohnDoe"
    }
  ]
}

Attributes

The following attributes are valid on an AWS storage bucket resource:

disable_credential_rotation (bool): If true, credential rotation will not be performed.
region (string): The region to configure the storage bucket for.
endpoint-url (string): The endpoint to configure the storage.
role_arn (string): The role arn configured for the assume role provider.
role_external_id (string): The external id configured for the assume role provider.
role_session_name (string): The session name configured for the assume role provider.
role_tags (object): The key-value pair tags configured for the assume role provider.

An example of how to utilize the endpoint attribute See the Credential Rotation readme for more information.

Secrets

The following secrets are optional on an AWS storage bucket resource:

access_key_id (string): The access key ID for the IAM user to use with this storage bucket.
secret_access_key (string): The secret access key for the IAM user to use with this storage bucket.

See the Credential Rotation readme for more information.