Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(iam auth): allow iam roles anywhere auth profile #3591

Open
wants to merge 22 commits into
base: main
Choose a base branch
from

Conversation

sicoyle
Copy link
Contributor

@sicoyle sicoyle commented Nov 4, 2024

Description

The overall logic for this auth profile + it's proper rotation is completed. I just need to update to add a mock for the authprovider clients, update the rest of the existing tests, and wrap up adding new ones.

Summary: Add an auth profile for using AWS IAM Roles Anywhere. This leverages x.509 certificates to establish trust between an AWS account and a trusted certificate authority. Here, we can use the Dapr SVID very nicely.

I had to do an overhaul on the existing AWS IAM setup because now it is the case that there is the existing static IAM auth with things like accesskeys, secretkeys, etc. However, now, I'm adding temporary auth that Dapr is responsible for rotating. Default expiration time with AWS for IAM Roles Anywhere session durations is 1hour, so that is our default with a rotation when we've hit half of that time in a goroutine if that auth profile is picked up. If a user sets a session duration for timeout, then we will not rotate the credentials.

This applies to all existing AWS components.

I plan to add for Postgres + Kafka in a secondary PR since this one is already so beefy.

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #[issue number]

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

  • Code compiles correctly
  • Created/updated tests - TODO
  • Extended the documentation / Created issue in the https://github.com/dapr/docs/ repo: dapr/docs#[issue number] TODO

@sicoyle sicoyle requested review from a team as code owners November 4, 2024 19:41
.build-tools/builtin-authentication-profiles.yaml Outdated Show resolved Hide resolved
common/authentication/aws/x509_iam.go Outdated Show resolved Hide resolved
bindings/aws/kinesis/kinesis.go Outdated Show resolved Hide resolved
common/authentication/aws/aws_client.go Outdated Show resolved Hide resolved
common/authentication/aws/x509_iam.go Outdated Show resolved Hide resolved
common/authentication/aws/x509_iam.go Outdated Show resolved Hide resolved
common/authentication/aws/x509_iam.go Outdated Show resolved Hide resolved
common/authentication/aws/aws_client.go Outdated Show resolved Hide resolved
common/authentication/aws/aws.go Outdated Show resolved Hide resolved
common/authentication/aws/aws.go Outdated Show resolved Hide resolved
@sicoyle
Copy link
Contributor Author

sicoyle commented Nov 12, 2024

I'm trying to inject mocked creds to make conformance tests pass for some of the aws components, but not too familiar with their setup. Clearly I need to adjust this further bc they're all failing... maybe add an IAM role on the terraform for IAM roles anywhere? or inject mock creds somewhere else? I had to do that for the unit tests for some of them... 🫠 I will come back to this tomorrow morning.

=== RUN   TestSecretStoreConformance/aws.secretsmanager.docker/get/get
    secretstores.go:84: 
        	Error Trace:	/home/runner/work/components-contrib/components-contrib/tests/conformance/secretstores/secretstores.go:84
        	Error:      	Received unexpected error:
        	            	couldn't get secret: UnrecognizedClientException: The security token included in the request is invalid.
        	            		status code: 400, request id: fbf08edb-02d5-47d2-b[60](https://github.com/dapr/components-contrib/actions/runs/11807458135/job/32894166961?pr=3591#step:24:61)a-4dcb432b6e8f
        	Test:       	TestSecretStoreConformance/aws.secretsmanager.docker/get/get
        	Messages:   	expected no error on getting secret {conftestsecret map[]}
--- FAIL: TestSecretStoreConformance/aws.secretsmanager.docker/get/get (0.06s)
--- FAIL: TestSecretStoreConformance/aws.secretsmanager.docker/get (0.06s)
=== RUN   TestSecretStoreConformance/aws.secretsmanager.docker/bulkGet
=== RUN   TestSecretStoreConformance/aws.secretsmanager.docker/bulkGet/bulkget
    secretstores.go:105: 
        	Error Trace:	/home/runner/work/components-contrib/components-contrib/tests/conformance/secretstores/secretstores.go:105
        	Error:      	Received unexpected error:
        	            	couldn't list secrets: UnrecognizedClientException: The security token included in the request is invalid.
        	            		status code: 400, request id: 4[70](https://github.com/dapr/components-contrib/actions/runs/11807458135/job/32894166961?pr=3591#step:24:71)14dae-011e-41ee-8420-d71d91fcb48d
        	Test:       	TestSecretStoreConformance/aws.secretsmanager.docker/bulkGet/bulkget
        	Messages:   	expected no error on getting secret {map[]}
--- FAIL: TestSecretStoreConformance/aws.secretsmanager.docker/bulkGet/bulkget (0.02s)
--- FAIL: TestSecretStoreConformance/aws.secretsmanager.docker/bulkGet (0.02s)
--- FAIL: TestSecretStoreConformance/aws.secretsmanager.docker (0.08s)
--- FAIL: TestSecretStoreConformance (0.08s)

Signed-off-by: Samantha Coyle <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants