Skip to content

Workload Identity: Roles Anywhere tbot service.#52426

Merged
strideynet merged 18 commits intomasterfrom
strideynet/aws-ra-credentials-workload-identity
Mar 25, 2025
Merged

Workload Identity: Roles Anywhere tbot service.#52426
strideynet merged 18 commits intomasterfrom
strideynet/aws-ra-credentials-workload-identity

Conversation

@strideynet
Copy link
Copy Markdown
Contributor

@strideynet strideynet commented Feb 24, 2025 •
edited
Loading

Closes #51915

version: v2
proxy_server: redacted
onboarding:
  join_method: kubernetes
  token: redacted
certificate_ttl: 24h
renewal_interval: 5m
storage:
  type: directory
  path: /Users/noah/code/gravitational/teleport-scratch/tbot/ra/storage
# outputs will be filled in during the completion of an access guide.
services:
  - type: workload-identity-aws-roles-anywhere
    destination:
      type: directory
      path: /Users/noah/code/gravitational/teleport-scratch/tbot/ra/out
    selector:
      name: ra-example
    role_arn: arn:aws:iam::redacted:role/noah_workload_id_gitlab_production
    profile_arn: arn:aws:rolesanywhere:us-west-2:redacted:profile/8260c238-fcb4-4d83-a529-e673b5b551d4
    trust_anchor_arn: arn:aws:rolesanywhere:us-west-2:redacted:trust-anchor/15f2a697-4b5d-42ae-9b9b-759f9250f4cd
➜  out AWS_PAGER="" AWS_SHARED_CREDENTIALS_FILE=/Users/noah/code/gravitational/teleport-scratch/tbot/ra/out/aws_credentials aws sts get-caller-identity
{
    "UserId": "redacted:00fec7212029bc6ef48006aa5c5b1f1222",
    "Account": "redacted",
    "Arn": "arn:aws:sts::redacted:assumed-role/noah_workload_id_gitlab_production/00fec7212029bc6ef48006aa5c5b1f1222"
}

changelog: Introduce workload-identity-aws-ra service for generating AWS credentials using Roles Anywhere directly from tbot.

@strideynet strideynet force-pushed the strideynet/aws-ra-credentials-workload-identity branch from a42d222 to fca1b43 Compare March 20, 2025 14:45
@strideynet strideynet marked this pull request as ready for review March 24, 2025 10:30
@strideynet strideynet mentioned this pull request Mar 24, 2025
Merged
boxofrad
boxofrad reviewed Mar 24, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@boxofrad boxofrad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking great! Excited to see this land 🚀

Comment thread lib/tbot/config/service_workload_identity_aws_ra.go Outdated
Comment thread lib/tbot/config/service_workload_identity_aws_ra.go
Comment thread lib/tbot/service_workload_identity_aws_ra_test.go
@strideynet strideynet requested a review from boxofrad March 24, 2025 16:35
marcoandredinis
marcoandredinis approved these changes Mar 25, 2025
View reviewed changes
Comment thread lib/tbot/config/service_workload_identity_aws_ra.go
@strideynet strideynet added this pull request to the merge queue Mar 25, 2025
Merged via the queue into master with commit eb90f7c Mar 25, 2025
43 checks passed
@strideynet strideynet deleted the strideynet/aws-ra-credentials-workload-identity branch March 25, 2025 15:26
@backport-bot-workflows
Copy link
Copy Markdown
Contributor

backport-bot-workflows Bot commented Mar 25, 2025

@strideynet See the table below for backport results.

Branch Result
branch/v16 Failed
branch/v17 Failed

strideynet added a commit that referenced this pull request Mar 25, 2025
@strideynet
Workload Identity: Roles Anywhere tbot service. (#52426)
17aeeef 
* Add config for WorkloadIdenttiyAWSRAService

* Add CLI command

* Start hacking on service impl

* Write credentials in AWS credentials file format

* Fix go.mod/go.sum

* Go mod tidy

* Add ARN validation

* Add specific config for AWS session duration/renewal

* Update golden file

* Fix gomod/gosum

* Refactor CheckAndSetDefaults

* Initialize service

* Update CLI flags

* Refactor & add tests

* Use *Context slog calls

* Update service name to include full `roles-anywhere`

* Add mocked AWS rolesanywhere API based test

* Validate region
@strideynet strideynet mentioned this pull request Mar 25, 2025
Closed
strideynet added a commit that referenced this pull request Mar 25, 2025
@strideynet
Workload Identity: Roles Anywhere tbot service. (#52426)
0a3d2ca 
* Add config for WorkloadIdenttiyAWSRAService

* Add CLI command

* Start hacking on service impl

* Write credentials in AWS credentials file format

* Fix go.mod/go.sum

* Go mod tidy

* Add ARN validation

* Add specific config for AWS session duration/renewal

* Update golden file

* Fix gomod/gosum

* Refactor CheckAndSetDefaults

* Initialize service

* Update CLI flags

* Refactor & add tests

* Use *Context slog calls

* Update service name to include full `roles-anywhere`

* Add mocked AWS rolesanywhere API based test

* Validate region
@strideynet strideynet mentioned this pull request Mar 25, 2025
Merged
github-merge-queue Bot pushed a commit that referenced this pull request Mar 25, 2025
@strideynet
[v17] Workload Identity: Roles Anywhere tbot service. (#52426) (#53408
9993350 
)

* Workload Identity: Roles Anywhere `tbot` service. (#52426)

* Add config for WorkloadIdenttiyAWSRAService

* Add CLI command

* Start hacking on service impl

* Write credentials in AWS credentials file format

* Fix go.mod/go.sum

* Go mod tidy

* Add ARN validation

* Add specific config for AWS session duration/renewal

* Update golden file

* Fix gomod/gosum

* Refactor CheckAndSetDefaults

* Initialize service

* Update CLI flags

* Refactor & add tests

* Use *Context slog calls

* Update service name to include full `roles-anywhere`

* Add mocked AWS rolesanywhere API based test

* Validate region

* Bump grpc to 1.68
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@boxofrad boxofrad boxofrad approved these changes

@marcoandredinis marcoandredinis marcoandredinis approved these changes

@ryanclark ryanclark ryanclark approved these changes

Assignees

No one assigned

Labels

backport/branch/v17 machine-id size/lg

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Workload Identity: tbot service for Roles Anywhere

4 participants

@strideynet @boxofrad @marcoandredinis @ryanclark