-
Notifications
You must be signed in to change notification settings - Fork 272
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
### Configure AWS sigv4 authentication for subgraph requests Secure your router to subgraph communication on AWS using [Signature Version 4](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) (Sigv4)! This changeset provides you with a way to set up hardcoded credentials, as well as a default provider chain. We recommend using the default provider chain configuration. Full use example: ```yaml authentication: subgraph: all: # configuration that will apply to all subgraphs aws_sig_v4: default_chain: profile_name: "my-test-profile" # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#ec2-instance-profile region: "us-east-1" # https://docs.aws.amazon.com/general/latest/gr/rande.html service_name: "lambda" # https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html assume_role: # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html role_arn: "test-arn" session_name: "test-session" external_id: "test-id" subgraphs: products: aws_sig_v4: hardcoded: # Not recommended, prefer using default_chain as shown above access_key_id: "my-access-key" secret_access_key: "my-secret-access-key" region: "us-east-1" service_name: "vpc-lattice-svcs" # "s3", "lambda" etc. ``` Full documentation can be found in the [router documentation](https://www.apollographql.com/docs/router/configuration/authn-subgraph).
- Loading branch information
Showing
18 changed files
with
1,593 additions
and
140 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| ### Configure AWS sigv4 authentication for subgraph requests ([PR #3365](https://github.com/apollographql/router/pull/3365)) | ||
|
|
||
| Secure your router to subgraph communication on AWS using [Signature Version 4](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html) (Sigv4)! | ||
| This changeset provides you with a way to set up hardcoded credentials, as well as a default provider chain. | ||
| We recommend using the default provider chain configuration. | ||
|
|
||
| Full use example: | ||
|
|
||
| ```yaml | ||
| authentication: | ||
| subgraph: | ||
| all: # configuration that will apply to all subgraphs | ||
| aws_sig_v4: | ||
| default_chain: | ||
| profile_name: "my-test-profile" # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#ec2-instance-profile | ||
| region: "us-east-1" # https://docs.aws.amazon.com/general/latest/gr/rande.html | ||
| service_name: "lambda" # https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html | ||
| assume_role: # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html | ||
| role_arn: "test-arn" | ||
| session_name: "test-session" | ||
| external_id: "test-id" | ||
| subgraphs: | ||
| products: | ||
| aws_sig_v4: | ||
| hardcoded: # Not recommended, prefer using default_chain as shown above | ||
| access_key_id: "my-access-key" | ||
| secret_access_key: "my-secret-access-key" | ||
| region: "us-east-1" | ||
| service_name: "vpc-lattice-svcs" # "s3", "lambda" etc. | ||
| ``` | ||
| The full documentation can be found in the [router documentation](https://www.apollographql.com/docs/router/configuration/authn-subgraph). | ||
| By [@o0Ignition0o](https://github.com/o0Ignition0o) and [@BlenderDude](https://github.com/BlenderDude) in https://github.com/apollographql/router/pull/3365 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
5 changes: 5 additions & 0 deletions
5
apollo-router/src/configuration/migrations/0010-auth-jwt.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| description: Move jwt configuration to authentication.router | ||
| actions: | ||
| - type: move | ||
| from: authentication.jwt | ||
| to: authentication.router.jwt |
Oops, something went wrong.