Workload Identity federation - integrated with IAM
- Dominant language
- Go
- Stars
- 666
- Forks
- 213
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 4
Description
**Is your feature request related to a problem? Please describe.**
Pull Request [#150 feat: use workload identity federation to gain access to google](https://github.com/awslabs/ssosync/pull/150) has already demonstrated the changes required, however it is currently a very breaking change.
**Describe the solution you'd like**
Accept the above PR into a feature branch, then:
- re-instate the existing mechanism alongside it.
- update QuickStarts Templates to use the method
- update documentation
- lab guide to show this method
**Creating the WIF trust with an IAM Role**
- [Configure Workload Identity Federation with AWS](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds)
The instructions here are a little ambiguous and focus on ec2 rather than Lambda.
***Cleanest approach (no impersonation)***
- [Deploying Workload Identity Federation between AWS and GCP](https://lantern.splunk.com/Platform_Data_Management/Unlock_Insights/Deploying_Workload_Identity_Federation_between_AWS_and_GCP#Method_2:_Native_STS_token_sequence) - Probably the cleanest method
- [Access Google Cloud Storage from AWS Lambda using Workload Identity Federation](https://dev.to/specky_shooter/access-google-cloud-storage-from-aws-lambda-using-workload-identity-federation-3laj)
***Alternate approach but still requires impersonation***
- [Authenticating to Google Cloud from an AWS Lambda function](https://jpassing.com/2023/12/14/authenticating-to-google-cloud-from-an-aws-lambda-function/)
- [From AWS Lambda to GCS: Keyless Multi-Cloud Access with Outbound Identity Federation](https://towardsaws.com/from-aws-lambda-to-gcs-keyless-multi-cloud-access-with-outbound-identity-federation-f72ceeb43ff1)
Contributor guide
Research direction
Start by reviewing pull request #150 and the existing QuickStarts Templates, documentation, and lab guide. Compare the proposed workload identity federation flow with the current mechanism and identify how both can coexist. Done means the feature is integrated without the breaking change, templates use the new method, and the documentation and lab guide explain it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, gcp, go
- Domain
- authentication, authorization, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100