Merge pull request #10238 from RoadieHQ/add-external-id-to-s3-integration

Add external ID to S3 integration

.changeset/olive-geese-chew.md

@@ -0,0 +1,10 @@
+---
+'@backstage/backend-common': patch
+'@backstage/integration': patch
+---
+
+Support external ID when assuming roles in S3 integration
+
+In order to assume a role created by a 3rd party as external
+ID is needed. This change adds an optional field to the s3
+integration configuration and consumes that in the AwsS3UrlReader.

docs/integrations/aws-s3/locations.md

@@ -37,6 +37,7 @@ integrations:
     - accessKeyId: ${AWS_ACCESS_KEY_ID}
       secretAccessKey: ${AWS_SECRET_ACCESS_KEY}
       roleArn: 'arn:aws:iam::xxxxxxxxxxxx:role/example-role'
+      externalId: 'some-id' # optional
 ```
 
 Configuration allows specifying custom S3 endpoint, along with

packages/backend-common/src/reading/AwsS3UrlReader.ts

@@ -177,6 +177,7 @@ export class AwsS3UrlReader implements UrlReader {
         params: {
           RoleSessionName: 'backstage-aws-s3-url-reader',
           RoleArn: roleArn,
+          ExternalId: integration.config.externalId,
         },
       });
     }

packages/integration/api-report.md

@@ -35,6 +35,7 @@ export type AwsS3IntegrationConfig = {
   accessKeyId?: string;
   secretAccessKey?: string;
   roleArn?: string;
+  externalId?: string;
 };
 
 // @public

packages/integration/config.d.ts

@@ -225,6 +225,12 @@ export interface Config {
        * @visibility backend
        */
       roleArn?: string;
+
+      /**
+       * External ID to use when assuming role
+       * @visibility backend
+       */
+      externalId?: string;
     }>;
   };
 }

packages/integration/src/awsS3/config.ts

@@ -59,6 +59,11 @@ export type AwsS3IntegrationConfig = {
    * (Optional) ARN of role to be assumed
    */
   roleArn?: string;
+
+  /**
+   * (Optional) External ID to use when assuming role
+   */
+  externalId?: string;
 };
 
 /**
@@ -98,6 +103,7 @@ export function readAwsS3IntegrationConfig(
   const accessKeyId = config.getOptionalString('accessKeyId');
   const secretAccessKey = config.getOptionalString('secretAccessKey');
   const roleArn = config.getOptionalString('roleArn');
+  const externalId = config.getOptionalString('externalId');
 
   return {
     host,
@@ -106,6 +112,7 @@ export function readAwsS3IntegrationConfig(
     accessKeyId,
     secretAccessKey,
     roleArn,
+    externalId,
   };
 }