From b08ea0d2ecc95d3ae5458a60b3349ffa0d55590f Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Fri, 6 Aug 2021 17:31:05 +0100 Subject: [PATCH 1/3] add ability to specify an external id for assumed role for k8 From the AWS documentation. A cross-account role is usually set up to trust everyone in an account. Therefore, the administrator of the trusting account might send an external ID to the administrator of the trusted account. That way, only someone with the ID can assume the role, rather than everyone in the account. Signed-off-by: Brian Fletcher --- .../AwsIamKubernetesAuthTranslator.ts | 15 +++++++++++---- plugins/kubernetes-backend/src/types/types.ts | 1 + 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts index 101bed32a3..111ed1cf56 100644 --- a/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts +++ b/plugins/kubernetes-backend/src/kubernetes-auth-translator/AwsIamKubernetesAuthTranslator.ts @@ -55,7 +55,10 @@ export class AwsIamKubernetesAuthTranslator }); }; - async getCredentials(assumeRole: string | undefined): Promise { + async getCredentials( + assumeRole?: string, + externalId?: string, + ): Promise { return new Promise(async (resolve, reject) => { const awsCreds = await this.awsGetCredentials(); @@ -73,10 +76,12 @@ export class AwsIamKubernetesAuthTranslator if (!assumeRole) return resolve(creds); try { - const params = { + const params: AWS.STS.Types.AssumeRoleRequest = { RoleArn: assumeRole, RoleSessionName: 'backstage-login', }; + if (externalId) params.ExternalId = externalId; + const assumedRole = await new AWS.STS().assumeRole(params).promise(); if (!assumedRole.Credentials) { @@ -97,9 +102,10 @@ export class AwsIamKubernetesAuthTranslator } async getBearerToken( clusterName: string, - assumeRole: string | undefined, + assumeRole?: string, + externalId?: string, ): Promise { - const credentials = await this.getCredentials(assumeRole); + const credentials = await this.getCredentials(assumeRole, externalId); const request = { host: `sts.amazonaws.com`, @@ -132,6 +138,7 @@ export class AwsIamKubernetesAuthTranslator clusterDetailsWithAuthToken.serviceAccountToken = await this.getBearerToken( clusterDetails.name, clusterDetails.assumeRole, + clusterDetails.externalId, ); return clusterDetailsWithAuthToken; } diff --git a/plugins/kubernetes-backend/src/types/types.ts b/plugins/kubernetes-backend/src/types/types.ts index 6409229968..f4bb019108 100644 --- a/plugins/kubernetes-backend/src/types/types.ts +++ b/plugins/kubernetes-backend/src/types/types.ts @@ -86,4 +86,5 @@ export interface GKEClusterDetails extends ClusterDetails {} export interface ServiceAccountClusterDetails extends ClusterDetails {} export interface AWSClusterDetails extends ClusterDetails { assumeRole?: string; + externalId?: string; } From bbcd92afacb8e0633b93024f37d5d2373995fac3 Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Fri, 6 Aug 2021 17:36:15 +0100 Subject: [PATCH 2/3] adds changeset Signed-off-by: Brian Fletcher --- .changeset/four-buttons-design.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/four-buttons-design.md diff --git a/.changeset/four-buttons-design.md b/.changeset/four-buttons-design.md new file mode 100644 index 0000000000..172d011057 --- /dev/null +++ b/.changeset/four-buttons-design.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-kubernetes-backend': patch +--- + +Adds ability to send an ExternalId with the assume role request to AWS From a9c11c699cf6f8ee24ef60be6b0b3ea9de7ad65c Mon Sep 17 00:00:00 2001 From: Brian Fletcher Date: Fri, 6 Aug 2021 19:45:36 +0100 Subject: [PATCH 3/3] adds api-report file to pull request Signed-off-by: Brian Fletcher --- plugins/kubernetes-backend/api-report.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/plugins/kubernetes-backend/api-report.md b/plugins/kubernetes-backend/api-report.md index 899f1fff00..f69977f5ad 100644 --- a/plugins/kubernetes-backend/api-report.md +++ b/plugins/kubernetes-backend/api-report.md @@ -16,6 +16,8 @@ import { Logger as Logger_2 } from 'winston'; export interface AWSClusterDetails extends ClusterDetails { // (undocumented) assumeRole?: string; + // (undocumented) + externalId?: string; } // Warning: (ae-missing-release-tag) "ClusterDetails" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)