awslabs / awslabs/ssosync

Workload Identity federation - integrated with IAM

Open
#321 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
666
Forks
213
Avg merge
1d 7h
Merged PRs (30d)
4

Description

**Is your feature request related to a problem? Please describe.**
Pull Request [#150 feat: use workload identity federation to gain access to google](https://github.com/awslabs/ssosync/pull/150) has already demonstrated the changes required, however it is currently a very breaking change.

**Describe the solution you'd like**
Accept the above PR into a feature branch, then:
- re-instate the existing mechanism alongside it.
- update QuickStarts Templates to use the method
- update documentation
- lab guide to show this method

**Creating the WIF trust with an IAM Role**
- [Configure Workload Identity Federation with AWS](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds)
The instructions here are a little ambiguous and focus on ec2 rather than Lambda.

***Cleanest approach (no impersonation)***
- [Deploying Workload Identity Federation between AWS and GCP](https://lantern.splunk.com/Platform_Data_Management/Unlock_Insights/Deploying_Workload_Identity_Federation_between_AWS_and_GCP#Method_2:_Native_STS_token_sequence) - Probably the cleanest method
- [Access Google Cloud Storage from AWS Lambda using Workload Identity Federation](https://dev.to/specky_shooter/access-google-cloud-storage-from-aws-lambda-using-workload-identity-federation-3laj)

***Alternate approach but still requires impersonation***
- [Authenticating to Google Cloud from an AWS Lambda function](https://jpassing.com/2023/12/14/authenticating-to-google-cloud-from-an-aws-lambda-function/)
- [From AWS Lambda to GCS: Keyless Multi-Cloud Access with Outbound Identity Federation](https://towardsaws.com/from-aws-lambda-to-gcs-keyless-multi-cloud-access-with-outbound-identity-federation-f72ceeb43ff1)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing pull request #150 and the existing QuickStarts Templates, documentation, and lab guide. Compare the proposed workload identity federation flow with the current mechanism and identify how both can coexist. Done means the feature is integrated without the breaking change, templates use the new method, and the documentation and lab guide explain it.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, gcp, go
Domain
authentication, authorization, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.