Add AWS SSO native credential support #52
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github.com/aws/aws-sdk-go v1.37.8+ adds native support for AWS SSO credentials. This is crucial for users who have adopted AWS SSO, and allows for user without workarounds via `credential_process`. Example ~/.aws/config: ``` [profile sso] region = us-east-2 sso_start_url = https://d-1234567890.awsapps.com/start/ sso_region = us-east-1 sso_account_id = 123456789012 sso_role_name = AWSPowerUserAccess ```
This is necessary for tests to pass.
|
|
|
|
|
I cannot get |
|
@masteinhauser I get errors when I try to build: I was able to fix this very simply by running |
|
@PettitWesley Thanks for the response! After running Please re-review with the new commit 49f5649 |
|
Hello @PettitWesley! What else is needed here to get this PR tested + merged? |
PettitWesley
approved these changes
Mar 2, 2021
Open
|
Sorry to bring this back up, so what is the way of using ecs local endpoints with sso? I have my aws configured correctly and i have this as the docker.compose.override: version: "3.7"
networks:
This special network is configured so that the local metadata
service can bind to the specific IP address that ECS uses
in development
credentials_network:
driver: bridge
ipam:
config:
- subnet: "169.254.170.0/24"
services:
This container vends credentials to your containers
ecs-local-endpoints:
# The Amazon ECS Local Container Endpoints Docker Image
image: amazon/amazon-ecs-local-container-endpoints
volumes:
# Mount /var/run so we can access docker.sock and talk to Docker
- /var/run:/var/run
# Mount the shared configuration directory, used by the AWS CLI and AWS SDKs
# On Windows, this directory can be found at "%UserProfile%.aws"
- $HOME/.aws/:/home/.aws/
environment:
# define the home folder; credentials will be read from $HOME/.aws
HOME: "/home"
# You can change which AWS CLI Profile is used
AWS_PROFILE: "dev"
networks:
credentials_network:
# This special IP address is recognized by the AWS SDKs and AWS CLI
ipv4_address: "169.254.170.2"
Here we reference the application container that we are testing
You can test multiple containers at a time, simply duplicate this section
and customize it for each container, and give it a unique IP in 'credentials_network'.
local:
depends_on:
- ecs-local-endpoints
networks:
credentials_network:
ipv4_address: "169.254.170.3"
environment:
AWS_DEFAULT_REGION: "sa-east-1"
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI: "/role/my-ecs-role"I have to use version 3.7 because thats what my previous and main app is built on and i cannot (or i am not allowed) to step back to v2, maybe that's an issue. I have inspected the docker container and the volumes are set up correctly, i can access the aws credentials from inside the container. I have also set up the trust policy in my ecs role, but it seems that i cannot reach the host that returns the role name. I keep on getting this error:
Btw, i am trying to access dynamodb from the nodejs aws sdk |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue #51
Description of changes:
Enables support for AWS SSO credentials natively, without relying on
credential_processor the many other available workarounds.This also fixes mock generation, although I cannot explain why this was needed. I could not find any viable way to generate the mocks required to pass tests without this change, and the
vendordirectory removal.AWS Docs for configuration, and example:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.