Support loading AWS credentials from AWS profiles #2786
Comments
|
@olamiko would you want to work on this? |
|
@anderseknert, yes, I will like to work on this issue. Please assign me |
|
Hi team, are there any plans to implement this in the near to mid term? It would simplify our key rotation process since we currently need to restart our agents every 12 hours to refresh the credentials. |
|
@rgueldem we can prioritize this over the next few weeks. We should be able to land this in December. |
tsandall
added this to TODO (Things That Should Be Done)
in Open Policy Agent
via automation
tsandall
moved this from TODO (Things That Should Be Done)
to Planned (Things We Are Going To Do)
in Open Policy Agent
ashutosh-narkar
moved this from Planned (Things We Are Going To Do)
to In Progress
in Open Policy Agent
Earlier users could provide sensitive values such as AWS secret keys using environment variables. This change adds a new AWS credential provider which reads the credential file to fetch credentials for a named profile. If no profile is provided, the "default" profile is used. OPA reads the credentials from the file on each request and uses them for authentication. Fixes: open-policy-agent#2786 Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Earlier users could provide sensitive values such as AWS secret keys using environment variables. This change adds a new AWS credential provider which reads the credential file to fetch credentials for a named profile. If no profile is provided, the "default" profile is used. OPA reads the credentials from the file on each request and uses them for authentication. Fixes: open-policy-agent#2786 Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com> Co-authored-by: Stephan Renatus <stephan.renatus@gmail.com>
Thanks! Going by the description this should work for us. |
AWS supports storing credentials on disk and loading them into the AWS CLI as well as their SDK. We use that setup to integrate with S3 for our services and it would be great if OPA would be able to ingest these credentials as well instead of relying on environment variables.
Note, that the SDK profile credential provider supports rotation of credentials.
Expected Behavior
Ability to configure service credentials for S3 by referencing an AWS profile or by using the default AWS profile if none is set. Support for rotation of short-living credentials without restarts.
Actual Behavior
Need to pass in secrets via environment variable to set s3_signing option. Need to restart OPA when short-living credentials expire.
Steps to Reproduce the Problem
n/a
Additional Info
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html
https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/index.html?com/amazonaws/auth/profile/ProfileCredentialsProvider.html
https://docs.aws.amazon.com/sdk-for-go/api/aws/credentials/#NewSharedCredentials
The text was updated successfully, but these errors were encountered: