aws

package
v1.233.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: Apache-2.0 Imports: 43 Imported by: 0

README

AWS Cloud Package

This package provides AWS-specific functionality for the Atmos authentication system.

Session Duration Configuration

Session duration can be configured for both providers (SSO, SAML) and identities (IAM users):

auth:
  providers:
    company-sso:
      kind: aws/iam-identity-center
      session:
        duration: "8h"

  identities:
    emergency-admin:
      kind: aws/user
      session:
        duration: "12h"  # Formats: integers (seconds), Go durations ("1h"), or days ("1d")

AWS IAM user limits: 15m-12h (no MFA) or 15m-36h (with MFA). Default: 12h

Custom Endpoint URL

The AWS cloud package supports a custom endpoint URL, which is useful for testing with Floci, LocalStack, or other AWS-compatible services.

Configuration

You can configure a custom endpoint URL at either the identity or provider level:

Identity-Level Configuration

For identities, add endpoint_url to spec:

auth:
  identities:
    localstack-superuser:
      kind: aws/user
      credentials:
        access_key_id: test
        secret_access_key: test
        region: us-east-1
      spec:
        endpoint_url: "http://localhost:4566"
Provider-Level Configuration

For providers, add endpoint_url to spec:

auth:
  providers:
    localstack-sso:
      kind: aws/iam-identity-center
      start_url: https://localstack.awsapps.com/start/
      region: us-east-1
      spec:
        endpoint_url: "http://localhost:4566"

Legacy configurations using credentials.aws.resolver.url on identities or spec.aws.resolver.url on providers are still accepted, but new configuration should use spec.endpoint_url.

Precedence

When both identity and provider have endpoint configurations, the identity endpoint takes precedence. New spec.endpoint_url values take precedence over legacy aws.resolver.url values at the same level.

Usage

The custom endpoint URL is automatically applied when:

  • AWS identities authenticate (user, assume-role, permission-set)
  • AWS providers authenticate (SSO, SAML)

All AWS SDK calls will be directed to the configured endpoint URL.

Floci Example

For a complete AWS emulator example, see:

  • /examples/demo-floci/atmos.yaml
Implementation Details

The endpoint URL is implemented using AWS SDK v2's config.WithBaseEndpoint:

return config.WithBaseEndpoint(url)

This ensures all AWS services (STS, SSO, etc.) use the custom endpoint. The base endpoint approach is the recommended method in AWS SDK v2 for setting custom endpoints.

Process Credentials (credential_process)

credential_process.go implements the AWS process-credential format for both directions of Atmos Auth's credential_process support.

Producing credentials

NewProcessCredentials converts Atmos AWS credentials into the process-credential document and MarshalProcessCredentials renders it as compact JSON:

{"Version":1,"AccessKeyId":"ASIA...","SecretAccessKey":"...","SessionToken":"...","Expiration":"2026-10-02T18:30:00Z"}

SessionToken and Expiration are omitted when empty (long-lived keys). Expiration is RFC3339 in UTC. This backs atmos aws credential-process and atmos auth env --format=credential-process.

Consuming a helper

RetrieveProcessCredentials runs a configured credential_process command on behalf of the aws/credential-process identity and returns the credentials it prints.

  • The command runs through the platform shell, like the AWS SDK for Go: sh -c on Linux and macOS, %COMSPEC% /S /C "<command>" on Windows (via pkg/process.NewShellCommand). The AWS CLI does not use a shell, so pipes and environment variable expansion work in Atmos only. Stdin and stderr are inherited so a helper can prompt for MFA when Atmos runs interactively.
  • The default timeout is 1 minute. WithCredentialProcessTimeout overrides it for Go callers, but the aws/credential-process identity does not expose it, so users cannot change it. exec.Cmd.WaitDelay (2 seconds) bounds how long Wait blocks on the output pipe after a timeout kill.
  • ATMOS_AUTH_CREDENTIAL_PROCESS_CHAIN is set for every helper to detect recursion when a helper calls back into Atmos for an identity that is already resolving.
  • Errors never include the helper's stdout, because the AWS SDK embeds raw output in parse errors. Invalid output is reported as the list of missing or invalid fields without their values.
  • WithCredentialProcessCommandBuilder and WithCredentialProcessEnviron let tests substitute the command builder and base environment.

See docs/prd/aws-credential-process.md for the full design.

Documentation

Index

Constants

View Source 
const (
	// AWSFederationEndpoint is the AWS console federation endpoint.
	AWSFederationEndpoint = "https://signin.aws.amazon.com/federation"

	// AWSConsoleDestination is the default AWS console destination.
	AWSConsoleDestination = "https://console.aws.amazon.com/"

	// AWSMaxSessionDuration is the maximum session duration for AWS console (12 hours).
	AWSMaxSessionDuration = 12 * time.Hour

	// AWSDefaultSessionDuration is the default session duration (1 hour).
	AWSDefaultSessionDuration = 1 * time.Hour

	// AWSMinSessionDuration is the minimum session duration for AWS console (15 minutes).
	AWSMinSessionDuration = 15 * time.Minute

	// AWSDefaultSigninTokenExpiration is the signin token expiration enforced by AWS (15 minutes, not configurable).
	// This is the time you have to click the generated URL before it expires.
	// To control how long you stay logged into the console, configure provider.console.session_duration.
	AWSDefaultSigninTokenExpiration = 15 * time.Minute
)
View Source 
const (
	// CredentialProcessVersion is the only process-credential payload version defined by AWS.
	CredentialProcessVersion = 1

	// CredentialProcessChainEnvVar carries the comma-separated list of Atmos identities whose
	// credential_process is currently executing. It is propagated to every child process so a
	// helper that (directly or transitively) calls back into Atmos for the same identity is
	// detected instead of recursing forever.
	CredentialProcessChainEnvVar = "ATMOS_AUTH_CREDENTIAL_PROCESS_CHAIN"

	// DefaultCredentialProcessTimeout matches the AWS SDK default for credential_process.
	DefaultCredentialProcessTimeout = processcreds.DefaultTimeout
)
View Source 
const (
	// ECRPublicRegistryURL is the fixed registry URL for ECR Public.
	ECRPublicRegistryURL = "public.ecr.aws"

	// ECRPublicAuthRegion is the only region that supports ECR Public authentication.
	// AWS docs: "always authenticate to the us-east-1 Region".
	ECRPublicAuthRegion = "us-east-1"
)
View Source 
const (
	PermissionRWX = 0o700
	PermissionRW  = 0o600
)

Variables

View Source 
var (
	ErrGetHomeDir                    = errors.New("failed to get home directory")
	ErrCreateCredentialsFile         = errors.New("failed to create credentials file")
	ErrCreateConfigFile              = errors.New("failed to create config file")
	ErrLoadCredentialsFile           = errors.New("failed to load credentials file")
	ErrLoadConfigFile                = errors.New("failed to load config file")
	ErrWriteCredentialsFile          = errors.New("failed to write credentials file")
	ErrWriteConfigFile               = errors.New("failed to write config file")
	ErrSetCredentialsFilePermissions = errors.New("failed to set credentials file permissions")
	ErrSetConfigFilePermissions      = errors.New("failed to set config file permissions")
	ErrProfileSection                = errors.New("failed to get profile section")
	ErrCleanupAWSFiles               = errors.New("failed to cleanup AWS files")
	ErrFileLockTimeout               = errors.New("failed to acquire file lock within timeout")
	ErrRemoveProfile                 = errors.New("failed to remove profile")
)
View Source 
var ECRPublicSupportedRegions = map[string]bool{
	"us-east-1": true,
	"us-west-2": true,
}

ECRPublicSupportedRegions contains the regions where ECR Public service endpoints exist. Auth (GetAuthorizationToken) is only supported in us-east-1, but the service has endpoints in both us-east-1 and us-west-2 for other API operations.

View Source 
var ServiceDestinations = map[string]string{}/* 117 elements not displayed */

ServiceDestinations maps common AWS service aliases to their console URLs. This allows users to use shorthand like "s3" instead of full URLs.

Functions

func BuildAWSConfigFromCreds added in v1.211.0 

func BuildAWSConfigFromCreds(ctx context.Context, creds types.ICredentials, region string) (aws.Config, error)

BuildAWSConfigFromCreds creates an AWS config from Atmos credentials. Used by ECR and EKS integrations to create AWS SDK clients.

func BuildKubeClusterInfo added in v1.226.0 

func BuildKubeClusterInfo(info *EKSClusterInfo, identityName string) *kube.ClusterInfo

BuildKubeClusterInfo adapts an EKSClusterInfo + identity name into the cloud-agnostic kube.ClusterInfo, building the "aws eks token" exec-plugin command line that kube.BuildClusterConfig embeds verbatim.

func BuildRegistryURL added in v1.203.0 

func BuildRegistryURL(accountID, region string) string

BuildRegistryURL constructs ECR registry URL from account ID and region.

func DefaultCredentialProcessCommandBuilder 

func DefaultCredentialProcessCommandBuilder(ctx context.Context, command string, env []string) (*exec.Cmd, error)

DefaultCredentialProcessCommandBuilder runs the command through the platform shell like the AWS SDKs do (`sh -c` on Unix, `cmd.exe /S /C` on Windows with the command line passed verbatim so quoted paths survive), so a command copied from ~/.aws/config behaves the same. Stdin and stderr are inherited so helpers can prompt for MFA or print browser-login instructions.

func GetAliasByCategory added in v1.196.0 

func GetAliasByCategory() map[string][]string

GetAliasByCategory returns aliases grouped by service category.

func GetAvailableAliases added in v1.196.0 

func GetAvailableAliases() []string

GetAvailableAliases returns a sorted list of all available service aliases.

func GetBaseEndpointConfigOption added in v1.222.0 

func GetBaseEndpointConfigOption(identity *schema.Identity, provider *schema.Provider) config.LoadOptionsFunc

GetBaseEndpointConfigOption extracts the AWS base endpoint configuration from identity or provider and returns an AWS config option. Returns nil if no endpoint is configured. New spec.endpoint_url values take precedence over legacy aws.resolver.url values.

func GetFilesBasePath added in v1.196.0 

func GetFilesBasePath(provider *schema.Provider) string

GetFilesBasePath extracts files.base_path from provider spec. Returns empty string if not configured.

func GetResolverConfigOption added in v1.195.0 

func GetResolverConfigOption(identity *schema.Identity, provider *schema.Provider) config.LoadOptionsFunc

GetResolverConfigOption is kept for compatibility with existing callers. Use GetBaseEndpointConfigOption for new code.

func GetToken added in v1.211.0 

func GetToken(ctx context.Context, creds types.ICredentials, clusterName, region string) (string, time.Time, error)

GetToken generates an EKS bearer token via STS pre-signed GetCallerIdentity URL. This follows the same approach as `aws eks get-token` / aws-iam-authenticator.

func IsECRPublicRegistry added in v1.221.0 

func IsECRPublicRegistry(url string) bool

IsECRPublicRegistry checks if a URL is the ECR Public registry.

func IsECRRegistry added in v1.203.0 

func IsECRRegistry(url string) bool

IsECRRegistry checks if a URL is an ECR registry URL.

func LoadAtmosManagedAWSConfig added in v1.196.0 

func LoadAtmosManagedAWSConfig(ctx context.Context, optFns ...func(*config.LoadOptions) error) (aws.Config, error)

LoadAtmosManagedAWSConfig loads AWS configuration while clearing external AWS environment variables but ALLOWING Atmos-managed credential files to be loaded.

This function should be used when you want to use credentials that Atmos has already written to ~/.aws/atmos/<provider>/ directories. Unlike LoadIsolatedAWSConfig, this function ALLOWS the AWS SDK to load from shared config files and respects AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, and AWS_CONFIG_FILE environment variables.

It only clears credentials-related variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) to prevent conflicts with file-based credentials.

Use this when: - Validating Atmos-managed credentials - Using credentials from the credential store - Any operation that needs to access previously authenticated credentials

Use LoadIsolatedAWSConfig for initial authentication (SSO device flow, etc.)

func LoadDefaultAWSCredentials added in v1.203.0 

func LoadDefaultAWSCredentials(ctx context.Context) (*types.AWSCredentials, error)

LoadDefaultAWSCredentials loads AWS credentials from environment and returns them as Atmos credentials. This is used for explicit registry mode where the caller wants to use ambient AWS credentials instead of Atmos identities.

func LoadINIFile added in v1.196.0 

func LoadINIFile(path string) (*ini.File, error)

LoadINIFile loads an INI file with options that preserve section comments. This is critical for maintaining expiration metadata in credentials files.

func LoadIsolatedAWSConfig added in v1.195.0 

func LoadIsolatedAWSConfig(ctx context.Context, optFns ...func(*config.LoadOptions) error) (aws.Config, error)

LoadIsolatedAWSConfig loads AWS configuration with problematic environment variables temporarily cleared to avoid conflicts with Atmos authentication.

This function wraps config.LoadDefaultConfig and ensures that external AWS environment variables AND shared config files don't interfere with the configuration loading process.

The AWS SDK by default loads from ~/.aws/config and ~/.aws/credentials even when AWS_PROFILE is not set. We provide empty file lists to completely prevent the SDK from reading any shared config or credentials files from the filesystem.

Use this for initial authentication (SSO device flow, etc.) when you want complete isolation. Use LoadAtmosManagedAWSConfig when you want to use Atmos-managed credential files.

func MarshalProcessCredentials 

func MarshalProcessCredentials(creds *types.AWSCredentials) ([]byte, error)

MarshalProcessCredentials renders AWS credentials as compact process-credential JSON.

func NewInvalidProcessOutputError 

func NewInvalidProcessOutputError(identityName, detail string) error

NewInvalidProcessOutputError reports that the helper printed something other than a valid version-1 process-credential document. The detail must describe the problem without echoing any of the helper's output, which contains secrets.

func ParseRegistryURL added in v1.203.0 

func ParseRegistryURL(registryURL string) (accountID, region string, err error)

ParseRegistryURL extracts account ID and region from ECR registry URL. Returns error if URL is not a valid ECR registry URL.

func PrepareEnvironment added in v1.196.0 

func PrepareEnvironment(environ map[string]string, profile, credentialsFile, configFile, region string) map[string]string

PrepareEnvironment configures environment variables for AWS SDK when using Atmos auth.

This function:

  1. Clears direct credential env vars to prevent conflicts with profile-based auth
  2. Sets AWS_SHARED_CREDENTIALS_FILE and AWS_CONFIG_FILE to Atmos-managed paths
  3. Sets AWS_PROFILE to the authenticated identity
  4. Configures region if provided
  5. Disables IMDS fallback to prevent accidental instance credential usage

Returns a NEW map with modifications - does not mutate the input.

Parameters:

  • environ: Current environment variables (map[string]string)
  • profile: AWS profile name (identity name)
  • credentialsFile: Path to AWS credentials file
  • configFile: Path to AWS config file
  • region: AWS region (optional)

func ResolveDestination added in v1.196.0 

func ResolveDestination(destination string) (string, error)

ResolveDestination converts a destination alias to a full console URL. If the input is already a URL (starts with http:// or https://), it returns it unchanged. Otherwise, it looks up the alias in the ServiceDestinations map.

func RetrieveProcessCredentials 

func RetrieveProcessCredentials(ctx context.Context, identityName, command string, opts ...CredentialProcessOption) (*types.AWSCredentials, error)

RetrieveProcessCredentials executes an AWS `credential_process` command on behalf of the given Atmos identity and returns the credentials it prints. Execution and payload validation are delegated to the AWS SDK's processcreds provider.

Error text never includes the command's stdout: the SDK embeds raw output in its parse errors, and that output contains secrets.

func SetAuthContext added in v1.196.0 

func SetAuthContext(params *SetAuthContextParams) error

SetAuthContext populates the AWS auth context with Atmos-managed credential paths. This enables in-process AWS SDK calls to use Atmos-managed credentials.

func SetEnvironmentVariables 

func SetEnvironmentVariables(authContext *schema.AuthContext, stackInfo *schema.ConfigAndStacksInfo) error

SetEnvironmentVariables derives AWS environment variables from AuthContext. This populates ComponentEnvSection/ComponentEnvList for spawned processes. The auth context is the single source of truth; this function derives from it.

Uses PrepareEnvironment helper to ensure consistent environment setup across all commands. This clears conflicting credential env vars, sets AWS files/profile/region, and disables IMDS.

Parameters:

  • authContext: Runtime auth context containing AWS credentials
  • stackInfo: Stack configuration to populate with environment variables

func SetupFiles 

func SetupFiles(providerName, identityName string, creds types.ICredentials, basePath, realm string) error

SetupFiles sets up AWS credentials and config files for the given identity. BasePath specifies the base directory for AWS files (from provider's files.base_path). Realm provides credential isolation for multi-repository environments. If empty, uses the default XDG config path.

func ValidateECRPublicRegion added in v1.221.0 

func ValidateECRPublicRegion(region string) error

ValidateECRPublicRegion validates that the given region is supported by ECR Public.

func ValidateFilesBasePath added in v1.196.0 

func ValidateFilesBasePath(provider *schema.Provider) error

ValidateFilesBasePath validates spec.files.base_path if provided.

func WithIsolatedAWSEnv added in v1.195.0 

func WithIsolatedAWSEnv(fn func() error) error

WithIsolatedAWSEnv temporarily clears problematic AWS environment variables, executes the provided function, then restores the original values.

This is used to prevent external AWS environment variables from interfering with Atmos's authentication flow. The AWS SDK reads these environment variables automatically, which can cause conflicts with Atmos-managed credentials.

Usage: 

err := WithIsolatedAWSEnv(func() error {
    cfg, err := config.LoadDefaultConfig(ctx)
    return err
})

Types

type AWSConfig added in v1.195.0 

type AWSConfig struct {
	Resolver *ResolverConfig `yaml:"resolver,omitempty" json:"resolver,omitempty" mapstructure:"resolver"`
}

AWSConfig defines the legacy AWS-specific configuration for providers and identities.

type AWSFileManager 

type AWSFileManager struct {
	// contains filtered or unexported fields
}

AWSFileManager provides helpers to manage AWS credentials/config files.

func NewAWSFileManager 

func NewAWSFileManager(basePath, realm string) (*AWSFileManager, error)

NewAWSFileManager creates a new AWS file manager instance. BasePath is optional and can be empty to use defaults. Realm is optional and provides credential isolation between different Atmos configurations. Precedence: 1) basePath parameter from provider spec, 2) XDG config directory.

Default path follows XDG Base Directory Specification:

  • Linux/macOS: $XDG_CONFIG_HOME/atmos (default: ~/.config/atmos)
  • Windows: %APPDATA%\atmos

With realm: {baseDir}/{realm}/aws/{provider}/credentials Without realm: {baseDir}/aws/{provider}/credentials

Respects ATMOS_XDG_CONFIG_HOME and XDG_CONFIG_HOME environment variables.

func (*AWSFileManager) Cleanup 

func (m *AWSFileManager) Cleanup(providerName string) error

Cleanup removes AWS files for the provider. Path structure: {baseDir}/{realm}/aws/{provider}/ (with realm) or {baseDir}/aws/{provider}/ (without realm).

func (*AWSFileManager) CleanupAll added in v1.196.0 

func (m *AWSFileManager) CleanupAll() error

CleanupAll removes the realm-specific directory (all providers for this realm). Only removes credentials for the current realm, preserving other realms. Path structure: {baseDir}/{realm}/ (with realm) or {baseDir}/aws/ (without realm).

func (*AWSFileManager) DeleteIdentity added in v1.196.0 

func (m *AWSFileManager) DeleteIdentity(ctx context.Context, providerName, identityName string) error

DeleteIdentity removes only the specified identity's sections from AWS INI files. This preserves other identities using the same provider. Uses file locking to prevent concurrent modification conflicts.

func (*AWSFileManager) GetBaseDir added in v1.196.0 

func (m *AWSFileManager) GetBaseDir() string

GetBaseDir returns the base directory path.

func (*AWSFileManager) GetCachePath added in v1.201.0 

func (m *AWSFileManager) GetCachePath() string

GetCachePath returns the AWS SDK cache directory path. AWS SDK uses ~/.aws/sso/cache or $XDG_CACHE_HOME/aws/sso/cache for SSO cache. Returns empty string if cache directory cannot be determined.

func (*AWSFileManager) GetConfigPath 

func (m *AWSFileManager) GetConfigPath(providerName string) string

GetConfigPath returns the path to the config file for the provider. Path structure: {baseDir}/{realm}/aws/{provider}/config (with realm) or {baseDir}/aws/{provider}/config (without realm, backward-compatible).

func (*AWSFileManager) GetCredentialsPath 

func (m *AWSFileManager) GetCredentialsPath(providerName string) string

GetCredentialsPath returns the path to the credentials file for the provider. Path structure: {baseDir}/{realm}/aws/{provider}/credentials (with realm) or {baseDir}/aws/{provider}/credentials (without realm, backward-compatible).

func (*AWSFileManager) GetDisplayPath added in v1.196.0 

func (m *AWSFileManager) GetDisplayPath() string

GetDisplayPath returns a user-friendly display path (with ~ if under home directory). Path includes realm subdirectory when realm is configured.

func (*AWSFileManager) GetEnvironmentVariables 

func (m *AWSFileManager) GetEnvironmentVariables(providerName, identityName string) []schema.EnvironmentVariable

GetEnvironmentVariables returns the AWS file environment variables as EnvironmentVariable slice.

func (*AWSFileManager) GetRealm added in v1.206.0 

func (m *AWSFileManager) GetRealm() string

GetRealm returns the realm used for credential isolation.

func (*AWSFileManager) RemoveConfigProfile added in v1.196.0 

func (m *AWSFileManager) RemoveConfigProfile(ctx context.Context, providerName, identityName string) error

RemoveConfigProfile removes an identity profile from the provider's config file. Uses file locking to prevent concurrent modification conflicts. If this is the last profile, the config file is removed entirely.

func (*AWSFileManager) RemoveCredentialsProfile added in v1.196.0 

func (m *AWSFileManager) RemoveCredentialsProfile(ctx context.Context, providerName, identityName string) error

RemoveCredentialsProfile removes an identity profile from the provider's credentials file. Uses file locking to prevent concurrent modification conflicts. If this is the last profile, the credentials file is removed entirely.

func (*AWSFileManager) WriteConfig 

func (m *AWSFileManager) WriteConfig(providerName, identityName, region, outputFormat string) error

WriteConfig writes AWS config to the provider-specific file with identity profile. Uses file locking to prevent concurrent modification conflicts.

func (*AWSFileManager) WriteCredentials 

func (m *AWSFileManager) WriteCredentials(providerName, identityName string, creds *types.AWSCredentials) error

WriteCredentials writes AWS credentials to the provider-specific file with identity profile. Uses file locking to prevent concurrent modification conflicts.

type ConsoleURLGenerator added in v1.196.0 

type ConsoleURLGenerator struct {
	// contains filtered or unexported fields
}

ConsoleURLGenerator generates AWS console federation URLs.

func NewConsoleURLGenerator added in v1.196.0 

func NewConsoleURLGenerator(httpClient http.Client) *ConsoleURLGenerator

NewConsoleURLGenerator creates a new ConsoleURLGenerator with the specified HTTP client.

func (*ConsoleURLGenerator) GetConsoleURL added in v1.196.0 

func (g *ConsoleURLGenerator) GetConsoleURL(ctx context.Context, creds types.ICredentials, options types.ConsoleURLOptions) (string, time.Duration, error)

GetConsoleURL generates an AWS console sign-in URL using temporary credentials.

IMPORTANT: There is NO AWS SDK method for console federation. The AWS federation endpoint (https://signin.aws.amazon.com/federation) is a web service separate from the AWS API and must be called directly via HTTP.

AWS Federation Endpoint Limitations:

  • SessionDuration parameter is ONLY valid with direct AssumeRole* operations
  • SessionDuration is NOT valid with GetFederationToken
  • SessionDuration is NOT valid with role chaining (role → role → role)
  • Including SessionDuration with role-chained credentials returns 400 Bad Request

Since Atmos uses role chaining (SSO → PermissionSet → AssumeRole), we MUST omit the SessionDuration parameter. AWS automatically uses the remaining validity of the source credentials (typically 1 hour for role chaining).

References:

func (*ConsoleURLGenerator) SupportsConsoleAccess added in v1.196.0 

func (g *ConsoleURLGenerator) SupportsConsoleAccess() bool

SupportsConsoleAccess returns true for AWS.

type CredentialProcessCommandBuilder 

type CredentialProcessCommandBuilder func(ctx context.Context, command string, env []string) (*exec.Cmd, error)

CredentialProcessCommandBuilder builds the command that runs a credential_process string. The returned command must not have Stdout set; output is captured by the caller.

type CredentialProcessOption 

type CredentialProcessOption func(*credentialProcessOptions)

CredentialProcessOption configures RetrieveProcessCredentials.

func WithCredentialProcessCommandBuilder 

func WithCredentialProcessCommandBuilder(builder CredentialProcessCommandBuilder) CredentialProcessOption

WithCredentialProcessCommandBuilder overrides how the command is built (used by tests).

func WithCredentialProcessEnviron 

func WithCredentialProcessEnviron(environ []string) CredentialProcessOption

WithCredentialProcessEnviron overrides the base environment passed to the command (defaults to os.Environ()).

func WithCredentialProcessTimeout 

func WithCredentialProcessTimeout(timeout time.Duration) CredentialProcessOption

WithCredentialProcessTimeout overrides the default execution timeout.

type ECRAuthResult added in v1.203.0 

type ECRAuthResult struct {
	Username  string    // Always "AWS".
	Password  string    // Decoded authorization token.
	Registry  string    // e.g., 123456789012.dkr.ecr.us-east-1.amazonaws.com.
	ExpiresAt time.Time // Token expiration time.
}

ECRAuthResult contains ECR authorization token information.

func GetAuthorizationToken added in v1.203.0 

func GetAuthorizationToken(ctx context.Context, creds types.ICredentials, accountID, region string) (*ECRAuthResult, error)

GetAuthorizationToken retrieves ECR credentials using AWS credentials. The accountID and region parameters are used to build the target registry URL. Note: The returned token works for any ECR registry the credentials have access to.

type ECRPublicAuthOption added in v1.221.0 

type ECRPublicAuthOption func(*ecrPublicAuthConfig)

ECRPublicAuthOption configures GetPublicAuthorizationToken behavior.

func WithECRPublicClient added in v1.221.0 

func WithECRPublicClient(client ECRPublicClient) ECRPublicAuthOption

WithECRPublicClient injects a custom ECR Public client (for testing).

type ECRPublicAuthResult added in v1.221.0 

type ECRPublicAuthResult struct {
	Username  string    // Always "AWS".
	Password  string    //nolint:gosec // G117: This is an authorization token, not a password secret.
	ExpiresAt time.Time // Token expiration time.
}

ECRPublicAuthResult contains ECR Public authorization token information.

func GetPublicAuthorizationToken added in v1.221.0 

func GetPublicAuthorizationToken(ctx context.Context, creds types.ICredentials, opts ...ECRPublicAuthOption) (*ECRPublicAuthResult, error)

GetPublicAuthorizationToken retrieves ECR Public credentials using AWS credentials. The auth call is always made to us-east-1, which is the only region that supports it.

type ECRPublicClient added in v1.221.0 

type ECRPublicClient interface {
	GetAuthorizationToken(ctx context.Context, params *ecrpublic.GetAuthorizationTokenInput, optFns ...func(*ecrpublic.Options)) (*ecrpublic.GetAuthorizationTokenOutput, error)
}

ECRPublicClient abstracts the AWS ECR Public API for testability.

type EKSClient added in v1.211.0 

type EKSClient interface {
	DescribeCluster(ctx context.Context, input *eks.DescribeClusterInput, opts ...func(*eks.Options)) (*eks.DescribeClusterOutput, error)
}

EKSClient defines the interface for EKS API calls (for testability).

func NewEKSClient added in v1.211.0 

func NewEKSClient(ctx context.Context, creds types.ICredentials, region string) (EKSClient, error)

NewEKSClient creates a new EKS client from Atmos credentials.

type EKSClusterInfo added in v1.211.0 

type EKSClusterInfo struct {
	Name                     string
	Endpoint                 string
	CertificateAuthorityData string
	ARN                      string
	Region                   string
}

EKSClusterInfo contains cluster data needed for kubeconfig generation.

func DescribeCluster added in v1.211.0 

func DescribeCluster(ctx context.Context, client EKSClient, clusterName, region string) (*EKSClusterInfo, error)

DescribeCluster retrieves cluster information needed for kubeconfig.

type ProcessCredentials 

type ProcessCredentials struct {
	Version         int    `json:"Version"`
	AccessKeyID     string `json:"AccessKeyId"`
	SecretAccessKey string `json:"SecretAccessKey"`
	SessionToken    string `json:"SessionToken,omitempty"`
	Expiration      string `json:"Expiration,omitempty"`
}

ProcessCredentials is the JSON document defined by the AWS SDKs for `credential_process`. See https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html. Optional fields are omitted when empty so long-lived credentials never emit a null or empty Expiration, which some SDKs reject.

func NewProcessCredentials 

func NewProcessCredentials(creds *types.AWSCredentials) (*ProcessCredentials, error)

NewProcessCredentials converts Atmos AWS credentials into the AWS process-credential format.

type ResolverConfig added in v1.195.0 

type ResolverConfig struct {
	URL string `yaml:"url" json:"url" mapstructure:"url"`
}

ResolverConfig defines the legacy custom endpoint resolver configuration for AWS services.

type SetAuthContextParams added in v1.196.0 

type SetAuthContextParams struct {
	AuthContext  *schema.AuthContext
	StackInfo    *schema.ConfigAndStacksInfo
	ProviderName string
	IdentityName string
	Credentials  types.ICredentials
	BasePath     string
	Manager      types.AuthManager
	Realm        string // Realm for credential isolation (optional).
}

SetAuthContextParams contains parameters for SetAuthContext.

Source Files

View all Source files

Directories

Path Synopsis
Package autherrors translates AWS credential failures into provider-neutral errors.
 Package autherrors translates AWS credential failures into provider-neutral errors.
Package credentialprocess produces AWS process-credential documents for Atmos identities.
 Package credentialprocess produces AWS process-credential documents for Atmos identities.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.