Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for signed GET requests for aws authentication #10961

Merged
merged 9 commits into from
Aug 15, 2023

Conversation

bluestealth
Copy link
Contributor

Adds support for signed GET requests of GetCallerIdentity for authenticating to vault using the aws iam method.

This is related to aws/aws-sdk-go-v2#1137

@vercel vercel bot temporarily deployed to Preview – vault-storybook February 21, 2021 02:43 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook February 21, 2021 03:03 Inactive
@bluestealth bluestealth changed the title Add support for signed GET requests for aws authenication Add support for signed GET requests for aws authentication Feb 21, 2021
@vercel vercel bot temporarily deployed to Preview – vault-storybook February 22, 2021 01:19 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 4, 2021 19:21 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 4, 2021 21:35 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 4, 2021 21:35 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 4, 2021 21:46 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 4, 2021 21:46 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 4, 2021 22:35 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 4, 2021 22:35 Inactive
@GromNaN
Copy link

GromNaN commented Mar 19, 2021

👍🏻 Thank you for working on it. Supporting presigned GET requests is a valuable feature to make integration easier. AWS SDKs offers method to presign requests, but we have to use "internals" in order to catch method/path/headers/body of the sts request.

@bluestealth bluestealth requested a review from a team July 13, 2021 00:55
@vercel vercel bot temporarily deployed to Preview – vault July 13, 2021 00:55 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook July 13, 2021 00:55 Inactive
@GromNaN
Copy link

GromNaN commented Apr 2, 2022

Hello, is there any security concern before adding this feature?

@maxcoulombe
Copy link
Contributor

Hey @bluestealth, thanks a lot for your work on this. Kudos for thinking about the tests and docs as well.

The code looks sound, my only 2 comments are really minor nitpicking. Do you think it'd be possible to update the branch to resolve the conflict and add a changelog entry so I can have one last look that everything is in order before approving?

The changelog could be something like:

10961.txt

```release-note:improvement
auth/aws: Added support for signed GET requests for authenticating to vault using the aws iam method.

Copy link
Contributor

@maxcoulombe maxcoulombe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks for the modification & adding the test case.

Don't worry about the Vercel step, from what I understand it does not work with forks. I validated the doc changes with cd website && make website and it's ok.

@maxcoulombe maxcoulombe requested a review from a team as a code owner August 15, 2023 19:04
@maxcoulombe maxcoulombe added this to the 1.15 milestone Aug 15, 2023
@maxcoulombe maxcoulombe merged commit d6b7e5b into hashicorp:main Aug 15, 2023
@maxcoulombe
Copy link
Contributor

maxcoulombe commented Aug 15, 2023

This completely slipped under my radar, apologies for the delay and thanks for that contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants