From a8c5f1a08f0417c8725b7fde9e9b402e489b7b6b Mon Sep 17 00:00:00 2001 From: Iain Billett Date: Thu, 10 Mar 2022 14:41:07 +0000 Subject: [PATCH 1/5] Add an optional external Id field Signed-off-by: Iain Billett --- packages/backend-common/src/reading/AwsS3UrlReader.ts | 4 ++++ packages/integration/config.d.ts | 6 ++++++ packages/integration/src/awsS3/config.ts | 7 +++++++ 3 files changed, 17 insertions(+) diff --git a/packages/backend-common/src/reading/AwsS3UrlReader.ts b/packages/backend-common/src/reading/AwsS3UrlReader.ts index e64334321d..86ff0e7d65 100644 --- a/packages/backend-common/src/reading/AwsS3UrlReader.ts +++ b/packages/backend-common/src/reading/AwsS3UrlReader.ts @@ -154,11 +154,15 @@ export class AwsS3UrlReader implements UrlReader { const roleArn = integration.config.roleArn; if (roleArn) { + const externalIdParam = integration.config.externalId + ? { ExternalId: integration.config.externalId } + : {}; return new aws.ChainableTemporaryCredentials({ masterCredentials: explicitCredentials, params: { RoleSessionName: 'backstage-aws-s3-url-reader', RoleArn: roleArn, + ...externalIdParam, }, }); } diff --git a/packages/integration/config.d.ts b/packages/integration/config.d.ts index 8873f0f220..0b88a8ff81 100644 --- a/packages/integration/config.d.ts +++ b/packages/integration/config.d.ts @@ -200,6 +200,12 @@ export interface Config { * @visibility backend */ roleArn?: string; + + /** + * External ID to use when assuming role + * @visibility backend + */ + externalId?: string; }>; }; } diff --git a/packages/integration/src/awsS3/config.ts b/packages/integration/src/awsS3/config.ts index 45cbdbe210..2054b9eab0 100644 --- a/packages/integration/src/awsS3/config.ts +++ b/packages/integration/src/awsS3/config.ts @@ -59,6 +59,11 @@ export type AwsS3IntegrationConfig = { * (Optional) ARN of role to be assumed */ roleArn?: string; + + /** + * (optional) External ID to use when assuming role + */ + externalId?: string; }; /** @@ -98,6 +103,7 @@ export function readAwsS3IntegrationConfig( const accessKeyId = config.getOptionalString('accessKeyId'); const secretAccessKey = config.getOptionalString('secretAccessKey'); const roleArn = config.getOptionalString('roleArn'); + const externalId = config.getOptionalString('externalId'); return { host, @@ -106,6 +112,7 @@ export function readAwsS3IntegrationConfig( accessKeyId, secretAccessKey, roleArn, + externalId, }; } From 6927f8541a1b420e40261ee9a270c8a82453edc2 Mon Sep 17 00:00:00 2001 From: Iain Billett Date: Wed, 16 Mar 2022 12:09:27 +0000 Subject: [PATCH 2/5] Update API report Signed-off-by: Iain Billett --- packages/integration/api-report.md | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/integration/api-report.md b/packages/integration/api-report.md index 84bca54a90..d86acb291a 100644 --- a/packages/integration/api-report.md +++ b/packages/integration/api-report.md @@ -35,6 +35,7 @@ export type AwsS3IntegrationConfig = { accessKeyId?: string; secretAccessKey?: string; roleArn?: string; + externalId?: string; }; // @public From 3ef123bbf05258351c0952ecfc1ffb27ad059e8c Mon Sep 17 00:00:00 2001 From: Iain Billett Date: Wed, 16 Mar 2022 15:40:49 +0000 Subject: [PATCH 3/5] Add changeset Signed-off-by: Iain Billett --- .changeset/olive-geese-chew.md | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .changeset/olive-geese-chew.md diff --git a/.changeset/olive-geese-chew.md b/.changeset/olive-geese-chew.md new file mode 100644 index 0000000000..a08b73b4a7 --- /dev/null +++ b/.changeset/olive-geese-chew.md @@ -0,0 +1,10 @@ +--- +'@backstage/backend-common': patch +'@backstage/integration': patch +--- + +Support external ID when assuming roles in S3 integration + +In order to assume a role created by a 3rd party as external +ID is needed. This change adds an optional field to the s3 +integration configuration and consumes that in the AwsS3UrlReader. From 1fc19dd3ecfa7795c63ec6f1f40f04030165f209 Mon Sep 17 00:00:00 2001 From: Iain Billett Date: Wed, 16 Mar 2022 15:56:41 +0000 Subject: [PATCH 4/5] Add docs Signed-off-by: Iain Billett --- docs/integrations/aws-s3/locations.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/integrations/aws-s3/locations.md b/docs/integrations/aws-s3/locations.md index b0c6829e2c..9bac28f906 100644 --- a/docs/integrations/aws-s3/locations.md +++ b/docs/integrations/aws-s3/locations.md @@ -37,6 +37,7 @@ integrations: - accessKeyId: ${AWS_ACCESS_KEY_ID} secretAccessKey: ${AWS_SECRET_ACCESS_KEY} roleArn: 'arn:aws:iam::xxxxxxxxxxxx:role/example-role' + externalId: 'some-id' # optional ``` Configuration allows specifying custom S3 endpoint, along with From b70bdac61054b400510d4471949fca9316a7c417 Mon Sep 17 00:00:00 2001 From: Jussi Hallila Date: Thu, 17 Mar 2022 08:44:20 +0100 Subject: [PATCH 5/5] Modify based on code review comments. Signed-off-by: Jussi Hallila --- packages/backend-common/src/reading/AwsS3UrlReader.ts | 5 +---- packages/integration/src/awsS3/config.ts | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/packages/backend-common/src/reading/AwsS3UrlReader.ts b/packages/backend-common/src/reading/AwsS3UrlReader.ts index b3c7aae3bf..4dd68bf32c 100644 --- a/packages/backend-common/src/reading/AwsS3UrlReader.ts +++ b/packages/backend-common/src/reading/AwsS3UrlReader.ts @@ -172,15 +172,12 @@ export class AwsS3UrlReader implements UrlReader { const roleArn = integration.config.roleArn; if (roleArn) { - const externalIdParam = integration.config.externalId - ? { ExternalId: integration.config.externalId } - : {}; return new aws.ChainableTemporaryCredentials({ masterCredentials: explicitCredentials, params: { RoleSessionName: 'backstage-aws-s3-url-reader', RoleArn: roleArn, - ...externalIdParam, + ExternalId: integration.config.externalId, }, }); } diff --git a/packages/integration/src/awsS3/config.ts b/packages/integration/src/awsS3/config.ts index 2054b9eab0..477741b839 100644 --- a/packages/integration/src/awsS3/config.ts +++ b/packages/integration/src/awsS3/config.ts @@ -61,7 +61,7 @@ export type AwsS3IntegrationConfig = { roleArn?: string; /** - * (optional) External ID to use when assuming role + * (Optional) External ID to use when assuming role */ externalId?: string; };