Merge pull request #25010 from ooiyeefei/yooi/plugins-catalog-backend-module-aws

fix: Prefer accountId for AwsOrganizationCloudAccountProcessor authentication

.changeset/swift-kings-sparkle.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-aws': patch
+---
+
+`AwsOrganizationCloudAccountProcessor` configuration field `roleArn` is deprecated in favor of new field `accountId`

plugins/catalog-backend-module-aws/config.d.ts

@@ -26,8 +26,14 @@ export interface Config {
         provider: {
           /**
            * The role to be assumed by this processor
+           * @deprecated Use `accountId` instead.
            */
           roleArn?: string;
+
+          /**
+           * The AWS account ID to query for organizational data
+           */
+          accountId?: string;
         };
       };
     };

plugins/catalog-backend-module-aws/src/awsOrganization/config.test.ts

@@ -22,11 +22,13 @@ describe('readAwsOrganizationConfig', () => {
     const config = {
       provider: {
         roleArn: 'aws::arn::foo',
+        accountId: '111111111111',
       },
     };
     const actual = readAwsOrganizationConfig(new ConfigReader(config));
     const expected = {
       roleArn: 'aws::arn::foo',
+      accountId: '111111111111',
     };
     expect(actual).toEqual(expected);
   });

plugins/catalog-backend-module-aws/src/awsOrganization/config.ts

@@ -22,8 +22,14 @@ import { Config } from '@backstage/config';
 export type AwsOrganizationProviderConfig = {
   /**
    * The role to assume for the processor.
+   * @deprecated Use `accountId` instead.
    */
   roleArn?: string;
+
+  /**
+   * The AWS accountId
+   */
+  accountId?: string;
 };
 
 export function readAwsOrganizationConfig(
@@ -32,7 +38,9 @@ export function readAwsOrganizationConfig(
   const providerConfig = config.getOptionalConfig('provider');
 
   const roleArn = providerConfig?.getOptionalString('roleArn');
+  const accountId = providerConfig?.getOptionalString('accountId');
   return {
     roleArn,
+    accountId,
   };
 }

plugins/catalog-backend-module-aws/src/processors/AwsOrganizationCloudAccountProcessor.ts

@@ -59,10 +59,18 @@ export class AwsOrganizationCloudAccountProcessor implements CatalogProcessor {
   static async fromConfig(config: Config, options: { logger: LoggerService }) {
     const c = config.getOptionalConfig('catalog.processors.awsOrganization');
     const orgConfig = c ? readAwsOrganizationConfig(c) : undefined;
+
+    if (orgConfig?.roleArn) {
+      options.logger.warn(
+        'The roleArn configuration for AwsOrganizationCloudAccountProcessor ignores the role name, use accountId configuration instead',
+      );
+    }
+
     const awsCredentialsManager =
       DefaultAwsCredentialsManager.fromConfig(config);
     const credProvider = await awsCredentialsManager.getCredentialProvider({
       arn: orgConfig?.roleArn,
+      accountId: orgConfig?.accountId,
     });
     return new AwsOrganizationCloudAccountProcessor(
       credProvider,