Documentation
¶
Overview ¶
Package sts is the AWS STS AssumeRole reference provider for governance R9 (JIT credential dispensing).
One provider instance can serve many CredentialSpecs. Each spec resolves to a Credential closed over the target role ARN, session name, duration, and optional external-id / session policy. Every Materialize call issues a fresh STS AssumeRole → returns short-lived AWS_* env vars in the Materialization → the runner injects them into the tool's subprocess env.
SDK-free: STS AssumeRole is a single Query-API POST signed with SigV4. The signer here is a stripped-down copy of the Bedrock signer in forge-core/llm/providers/sigv4_transport.go — Forge's intentional pattern is to hand-roll narrow AWS calls rather than pull the full aws-sdk-go-v2 (~5 MB binary blow-up) for one endpoint. See docs/security/least-privilege-credentials.md.
Index ¶
Constants ¶
const ProviderName = "sts_assume_role"
ProviderName is the string used in CredentialSpec.Provider.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Credential ¶
type Credential struct {
// contains filtered or unexported fields
}
Credential is the materializer returned by Provider.NewCredential.
func (*Credential) Kind ¶
func (*Credential) Kind() string
Kind returns the provider name for audit-event tagging.
func (*Credential) Materialize ¶
func (c *Credential) Materialize(ctx context.Context, _ string, _ json.RawMessage) (credentials.Materialization, error)
Materialize returns short-lived AWS credentials as env vars.
Caches per-Credential: since Provider ignores per-call `args` (no scope-down based on tool input), every call for a given spec yields an equivalent credential, so serving the same materialization until TTL-minus-skew expiration is safe and strictly better than re-issuing on every tool call. Reviewer @initializ-mk asked for this — pre-fix, an agent that ran `aws` N times made N AssumeRole calls, adding latency per exec and risking account-level STS throttling.
The cache is per-Credential (per-spec) and read under a mutex so concurrent tool invocations from the same skill share.
No revocation callback — STS creds expire on their own; the runner records TTL for audit.
type Provider ¶
type Provider struct {
// HTTPClient is exposed for tests to point at an httptest.Server.
// Zero value → http.DefaultClient.
HTTPClient *http.Client
// Now overrides the clock for deterministic signature tests.
Now func() time.Time
}
Provider implements credentials.Provider.
func (Provider) NewCredential ¶
func (p Provider) NewCredential(_ context.Context, cs credentials.CredentialSpec) (credentials.Credential, error)
NewCredential validates spec and returns a Credential that will mint fresh STS creds on every Materialize call.
type Spec ¶
type Spec struct {
RoleARN string `json:"role_arn"`
SessionName string `json:"session_name,omitempty"`
ExternalID string `json:"external_id,omitempty"`
Duration string `json:"duration,omitempty"` // e.g. "15m", "1h"; default 15m
SessionPolicy string `json:"session_policy,omitempty"` // inline JSON, sent as Policy=
Region string `json:"region,omitempty"` // default us-east-1
Endpoint string `json:"endpoint,omitempty"` // override for tests
SourceAccessKey string `json:"source_access_key,omitempty"` // env var name; default AWS_ACCESS_KEY_ID
SourceSecretKey string `json:"source_secret_key,omitempty"` // env var name; default AWS_SECRET_ACCESS_KEY
SourceToken string `json:"source_token,omitempty"` // env var name; default AWS_SESSION_TOKEN
}
Spec is decoded from CredentialSpec.Spec.
Source Files