Missing support for Web Identity Tokens

[otterley]

v2 of the Go SDK is missing support for Web Identity Tokens. (It's present in SDK v1.)

Support for Web Identity Tokens is particularly crucial for Go services running in Amazon EKS, where IAM Roles for Service Accounts are now the officially-supported way for Kubernetes Pods to obtain AWS credentials without having to grant the entire EC2 instance (i.e., node) access via an EC2 Instance Role. This enables least-privilege access in multi-tenant environments. See https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html for details.

See aws/aws-sdk-go@2e1d76a for the commit that added support to v1 of the Go SDK.

[owlwalks]

v1 ref: https://github.com/aws/aws-sdk-go/blob/master/aws/credentials/stscreds/web_identity_provider.go

[hasheddan]

@jasdel do y'all have a timeline on when you would like this implemented? I would be happy to do the work 👍

[hasheddan]

@otterley @owlwalks I was able to develop a work around here that can be used until this feature is implemented. Here is an example for use with an RDS client:

func NewClient() (Client, error) {
	cfg, err := external.LoadDefaultAWSConfig()
	if err != nil {
		return nil, err
	}
	svc := sts.New(cfg)

	b, err := ioutil.ReadFile(os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE"))
	if err != nil {
		return nil, err
	}
	token := string(b)
	sess := strconv.FormatInt(time.Now().UnixNano(), 10)
	role := os.Getenv("AWS_ROLE_ARN")
	resp, err := svc.AssumeRoleWithWebIdentityRequest(
		&sts.AssumeRoleWithWebIdentityInput{
			RoleSessionName:  &sess,
			WebIdentityToken: &token,
			RoleArn:          &role,
		},
	).Send(context.TODO())
	if err != nil {
		return nil, err
	}
	creds := aws.Credentials{
		AccessKeyID:     aws.StringValue(resp.Credentials.AccessKeyId),
		SecretAccessKey: aws.StringValue(resp.Credentials.SecretAccessKey),
		SessionToken:    aws.StringValue(resp.Credentials.SessionToken),
	}
	shared := external.SharedConfig{
		Credentials: creds,
		Region:      os.Getenv("AWS_REGION"),
	}
	config, err := external.LoadDefaultAWSConfig(shared)
	if err != nil {
		return nil, err
	}
	return rds.New(config), err
}

Happy to answer any questions!

[skmcgrail]

The work to port this credential provider and a few other improvements should be landing soon. This is currently planned to be implemented as part of our sprint. Will update this once that PR is out for review.

[hasheddan]

@skmcgrail thanks for following up here! Let me know if I can be of any help