googleapis / googleapis/google-cloud-java

[google-auth-library-java] Workload Identity Federation should support ECS Fargate container credentials

未关闭
#12,605 4 条评论 37 个 reaction 已指派 0 人 在 GitHub 查看
priority: p3 type: feature request
主要语言
Java
星标
2.1k
派生
1.2k
平均合并
1 天 23 小时
30 天内合并 PR
157

描述

**Is your feature request related to a problem? Please describe.**
I am trying to use Workload Identity Federation on AWS ECS Fargate. It seems that `AwsCredentials.getAwsSecurityCredentials` ([code](https://github.com/googleapis/google-auth-library-java/blob/acc1ce3603435f1c0cf23b8606af71b05e566f2f/oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java#L319-L325
)) only supports EC2 metadata service and does not support [ECS Fargate container credential URL](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html).

**Describe the solution you'd like**
Google auth SDK should support [ECS Fargate container credential URL](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html) through environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`.

**Describe alternatives you've considered**
The alternative to use Workload Identity Federation on ECS Fargate is implementing the [REST authentication](https://cloud.google.com/iam/docs/using-workload-identity-federation#rest) myself.

贡献指南

打开贡献指南

调研方向

从 issue 链接的 oauth2_http/java/com/google/auth/oauth2/AwsCredentials.java 中的 getAwsSecurityCredentials 开始,检查如何获取 EC2 元数据凭据。添加对环境变量 AWS_CONTAINER_CREDENTIALS_RELATIVE_URI 的支持,以便 Workload Identity Federation 可以获取 ECS Fargate 凭据,然后验证生成的凭据能否通过现有的身份验证流程正常工作。

由索引模型根据 Issue 内容生成。

评估

技术栈
aws, java
领域
authentication, cloud
Issue 类型
功能
难度
3/5
预计耗时
1-2 天
活跃度
停滞
描述清晰度
描述清楚
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。