Documentation
¶
Overview ¶
Package awsauth provides AWS workload-identity configuration and validation for DriftlessAF agents.
Local agents authenticate with an AWS IAM Identity Center (SSO) profile. Google Cloud workloads can explicitly exchange metadata identity tokens for AWS credentials, refreshed in process. Other workloads authenticate with a web-identity token file and role ARN. Static AWS credentials and Bedrock API keys are rejected. ConfigFromEnv validates the selected mode, and Config.ValidateCredentials verifies the source chosen by the AWS SDK credential chain. Config.LoadAWSConfig additionally resolves the same refreshable provider for a model transport to bind directly. This keeps AWS authentication policy independent of any model transport.
Example ¶
Example demonstrates resolving an allowed AWS authentication mode and verifying the credential source selected by the AWS SDK.
package main
import (
"context"
"fmt"
"chainguard.dev/driftlessaf/agents/awsauth"
)
func main() {
cfg, err := awsauth.ConfigFromEnv(context.Background())
if err != nil {
return
}
if err := cfg.ValidateCredentials(context.Background()); err != nil {
return
}
fmt.Printf("AWS region: %s\n", cfg.Region)
}
Output:
Index ¶
Examples ¶
Constants ¶
const ( // EnvRegion names the required AWS region environment variable. EnvRegion = "AWS_REGION" // EnvProfile names the AWS IAM Identity Center (SSO) profile environment variable. EnvProfile = "AWS_PROFILE" // EnvRoleARN names the role assumed when using web identity. EnvRoleARN = "AWS_ROLE_ARN" // EnvGoogleAudience selects Google workload identity with this audience. EnvGoogleAudience = "AWS_GOOGLE_AUDIENCE" // EnvWebIdentityTokenFile names the file containing the web-identity token. EnvWebIdentityTokenFile = "AWS_WEB_IDENTITY_TOKEN_FILE" //nolint:gosec // G101: environment variable name, not a credential )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Region string
Profile string
// Google explicitly selects Google workload identity. Its zero value leaves
// the existing SSO or token-file credential chain in use.
Google GoogleConfig
}
Config identifies an allowed AWS credential configuration.
Profile is set for local AWS IAM Identity Center (SSO) authentication. It is empty for Google workload identity and file-based web identity. For the latter, the AWS SDK reads EnvRoleARN and EnvWebIdentityTokenFile from the environment.
func ConfigFromEnv ¶
ConfigFromEnv reads and validates SSO, Google workload identity, or token-file web-identity configuration. Static AWS credentials and Bedrock API keys are rejected.
func (Config) LoadAWSConfig ¶ added in v0.10.34
LoadAWSConfig loads the refreshable AWS configuration selected by cfg, verifies that its credential provider is backed by AWS IAM Identity Center (SSO) or web identity, and confirms that credentials are currently available. Callers can bind the returned provider directly to a transport so validation and request signing use the same credential chain.
Example ¶
ExampleConfig_LoadAWSConfig demonstrates resolving the validated, refreshable credential provider that a transport binds directly.
package main
import (
"context"
"fmt"
"chainguard.dev/driftlessaf/agents/awsauth"
)
func main() {
cfg := awsauth.Config{Region: "us-east-1", Profile: "engineering-sso"}
awsConfig, err := cfg.LoadAWSConfig(context.Background())
if err != nil {
return
}
fmt.Printf("AWS region: %s\n", awsConfig.Region)
}
Output:
type GoogleConfig ¶ added in v0.10.110
GoogleConfig identifies a Google workload allowed to assume an AWS role. The role trust policy must restrict the Google service account and audience.
Example ¶
ExampleGoogleConfig demonstrates explicit Google metadata identity for a Cloud Run workload. The role trust must authorize its service account.
package main
import (
"fmt"
"chainguard.dev/driftlessaf/agents/awsauth"
)
func main() {
cfg := awsauth.Config{Region: "us-east-1", Google: awsauth.GoogleConfig{
RoleARN: "arn:aws:iam::123456789012:role/BedrockInvoker",
Audience: "https://aws.example/skillup",
}}
fmt.Println(cfg.Google.Audience)
}
Output: https://aws.example/skillup
Source Files