mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Russell Bryant
aa483ecb9a
Add gateway-managed AWS STS credential refresh (provider-v2, #1576). The gateway calls sts:AssumeRole and writes three short-lived credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) to the provider record; the proxy re-signs requests with SigV4. Adds the aws and aws-s3 provider profiles and a declarative multi-output refresh model (additional_outputs) so one AssumeRole co-mints all three credentials. Signed-off-by: Russell Bryant <rbryant@redhat.com>
62 lines
2.3 KiB
YAML
62 lines
2.3 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
id: aws
|
|
display_name: AWS
|
|
description: Generic AWS access via STS temporary credentials
|
|
category: other
|
|
credentials:
|
|
- name: access_key_id
|
|
description: AWS access key ID (gateway-minted via STS)
|
|
env_vars: [AWS_ACCESS_KEY_ID]
|
|
required: true
|
|
refresh:
|
|
strategy: aws_sts_assume_role
|
|
refresh_before_seconds: 300
|
|
max_lifetime_seconds: 3600
|
|
# One AssumeRole call mints all three AWS credentials. The refresh is
|
|
# attached to access_key_id (primary); these outputs co-manage the
|
|
# secret key and session token on their sibling credentials.
|
|
additional_outputs:
|
|
- output: secret_access_key
|
|
credential: secret_access_key
|
|
- output: session_token
|
|
credential: session_token
|
|
material:
|
|
- name: role_arn
|
|
description: ARN of the IAM role to assume
|
|
required: true
|
|
secret: false
|
|
- name: session_name
|
|
description: Session name for CloudTrail attribution
|
|
required: false
|
|
secret: false
|
|
- name: external_id
|
|
description: External ID for cross-account role assumption
|
|
required: false
|
|
secret: false
|
|
- name: aws_region
|
|
description: AWS region for STS endpoint
|
|
required: false
|
|
secret: false
|
|
- name: aws_access_key_id
|
|
description: Long-lived IAM access key (only needed if gateway lacks ambient AWS credentials)
|
|
required: false
|
|
secret: false
|
|
- name: aws_secret_access_key
|
|
description: Long-lived IAM secret key (only needed if gateway lacks ambient AWS credentials)
|
|
required: false
|
|
secret: true
|
|
- name: aws_session_token
|
|
description: Session token for temporary source credentials (SSO or a prior AssumeRole); requires the access/secret pair
|
|
required: false
|
|
secret: true
|
|
- name: secret_access_key
|
|
description: AWS secret access key (co-managed with access_key_id)
|
|
env_vars: [AWS_SECRET_ACCESS_KEY]
|
|
required: true
|
|
- name: session_token
|
|
description: AWS session token (co-managed with access_key_id)
|
|
env_vars: [AWS_SESSION_TOKEN]
|
|
required: true
|