googleapis / googleapis/google-cloud-node

Feature request: Support Workload Identity Federation on AWS Fargate

Open
#7,739 0 comments 27 reactions 0 assignees View on GitHub
library: google-cloud-node-core priority: p3 type: feature request
Dominant language
TypeScript
Stars
3.2k
Forks
712
Avg merge
2d 3h
Merged PRs (30d)
99

Description

**Is your feature request related to a problem? Please describe.**
We run some workloads on AWS Fargate, these workloads communicate to Bigquery. At the moment we can't use Workload Identity Federation because Fargate has neither Metadata endpoint, nor environment variables like `AWS_ACCESS_KEY` or `AWS_SECRET_ACCESS_KEY`, on Fargate credentials obtained using an environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`.
So we have to provision service account keys, secure them, rotate them etc

**Describe the solution you'd like**
I'd like to use Workload Identity Federation and not worry about service account keys.

**Describe alternatives you've considered**
Running EC2 instead of Fargate

**Additional context**
There are some workarounds in internet like https://stackoverflow.com/questions/70194948/connection-error-from-aws-fargete-to-gcp-bigquery-by-using-workload-identity (for Python). they all require patching auth logic

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.