Skip to content

Improve gp idp login aws #18601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 25, 2023
Merged

Improve gp idp login aws #18601

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bdc8668
[idp aws login] Make AWS profile configurable
csweichel Aug 25, 2023
a7d44e1
Use workspaceID as session name
csweichel Aug 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 22 additions & 20 deletions components/gitpod-cli/cmd/idp-login-aws.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ import (
"fmt"
"os"
"os/exec"
"path/filepath"
"time"

"github.com/gitpod-io/gitpod/gitpod-cli/pkg/gitpod"
"github.com/spf13/cobra"
)

Expand All @@ -21,8 +21,8 @@ const (
)

var idpLoginAwsOpts struct {
RoleARN string
CredentialsFile string
RoleARN string
Profile string
}

var idpLoginAwsCmd = &cobra.Command{
Expand All @@ -42,7 +42,12 @@ var idpLoginAwsCmd = &cobra.Command{
return err
}

awsCmd := exec.Command("aws", "sts", "assume-role-with-web-identity", "--role-arn", idpLoginAwsOpts.RoleARN, "--role-session-name", fmt.Sprintf("gitpod-%d", time.Now().Unix()), "--web-identity-token", tkn)
wsInfo, err := gitpod.GetWSInfo(ctx)
if err != nil {
return err
}

awsCmd := exec.Command("aws", "sts", "assume-role-with-web-identity", "--role-arn", idpLoginAwsOpts.RoleARN, "--role-session-name", fmt.Sprintf("%s-%d", wsInfo.WorkspaceId, time.Now().Unix()), "--web-identity-token", tkn)
Copy link
Member

@akosyakov akosyakov Aug 25, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@csweichel I'm not familiar, just asking to confirm there is not any breaking changes which would require reconfiguring existing setups on client side

i.e. where role-session-name is used?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's not breaking. Sessions usually time out after one hour.

out, err := awsCmd.CombinedOutput()
if err != nil {
return fmt.Errorf("%w: %s", err, string(out))
Expand All @@ -60,15 +65,17 @@ var idpLoginAwsCmd = &cobra.Command{
return err
}

credentials := "[default]\n"
credentials += fmt.Sprintf("aws_access_key_id=%s\n", result.Credentials.AccessKeyId)
credentials += fmt.Sprintf("aws_secret_access_key=%s\n", result.Credentials.SecretAccessKey)
credentials += fmt.Sprintf("aws_session_token=%s\n", result.Credentials.SessionToken)

_ = os.MkdirAll(filepath.Dir(idpLoginAwsOpts.CredentialsFile), 0755)
err = os.WriteFile(idpLoginAwsOpts.CredentialsFile, []byte(credentials), 0600)
if err != nil {
return err
vars := map[string]string{
"aws_access_key_id": result.Credentials.AccessKeyId,
"aws_secret_access_key": result.Credentials.SecretAccessKey,
"aws_session_token": result.Credentials.SessionToken,
}
for k, v := range vars {
awsCmd := exec.Command("aws", "configure", "set", "--profile", idpLoginAwsOpts.Profile, k, v)
out, err := awsCmd.CombinedOutput()
if err != nil {
return fmt.Errorf("%w: %s", err, string(out))
}
}

return nil
Expand All @@ -79,11 +86,6 @@ func init() {
idpLoginCmd.AddCommand(idpLoginAwsCmd)

idpLoginAwsCmd.Flags().StringVar(&idpLoginAwsOpts.RoleARN, "role-arn", os.Getenv("IDP_AWS_ROLE_ARN"), "AWS role to assume (defaults to IDP_AWS_ROLE_ARN env var)")

home, err := os.UserHomeDir()
if err != nil {
panic(err)
}
idpLoginAwsCmd.Flags().StringVar(&idpLoginAwsOpts.CredentialsFile, "credentials-file", filepath.Join(home, ".aws", "credentials"), "path to the AWS credentials file")
_ = idpLoginAwsCmd.MarkFlagFilename("credentials-file")
idpLoginAwsCmd.Flags().StringVarP(&idpLoginAwsOpts.Profile, "profile", "p", "default", "AWS profile to configure")
_ = idpLoginAwsCmd.MarkFlagFilename("profile")
}