cloudposse / cloudposse/atmos

Support for AWS `credential_process` as an identity

Open
#1,734 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.4k
Forks
175
Avg merge
2d 3h
Merged PRs (30d)
134

Description

### Describe the Feature

Lovin' the look of the `atmos auth shell` feature.
But at our organization, we source our temporary AWS credentials from an external process.
We make heavy use of the [`credential_process`](https://docs.aws.amazon.com/sdkref/latest/guide/feature-process-credentials.html#feature-process-credentials-detail-path) property in AWS' shared config file.

### Expected Behavior

I expected that en external process could be specified as a source of temporary AWS credentials.

### Use Case

Mostly what was mentioned here: https://atmos.tools/blog/introducing-atmos-auth-shell/#the-problem

### Describe Ideal Solution

Add an `aws/process` kind for identity configuration in `auth.identities`.
Something like:
```yaml
auth:
identities:
staging:
kind: aws/process
credentials:
credential_process: '{{getenv "HOME"}}/.local/bin/external-process staging'
region: eu-west-1
```

### Alternatives Considered

_No response_

### Additional Context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the `atmos auth shell` entry point and the `auth.identities` configuration described in the issue, then review AWS's `credential_process` documentation. Done means an `aws/process` identity can read the configured `credential_process` and region to provide temporary credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
authentication, cli, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.