hashicorp / hashicorp/consul

Add AWS Automation from Consul CLI to Consul API SDK

Open
#19,796 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

#### Feature Description

Currently, performing `consul login -type aws-iam`, under the hood the consul cli performs the AWS authentication generating the sig v4 bearer token to send to the consul server for validation to obtain a consul token.

The `Login` method in the [API SDK](https://pkg.go.dev/github.com/hashicorp/consul/api#ACL.Login) requires a bearer be provided, and does not leverage the aws automation if you're using an aws authentication method.

A `bool` for `AwsAuth` in the [ACLLoginParams](https://pkg.go.dev/github.com/hashicorp/consul/api#ACLLoginParams) struct to denote this, so the bearer can be retrieved via the methods in the AWS section of the [Login Package](https://github.com/hashicorp/consul/blob/main/command/login/aws.go) of command can be leveraged for this, as opposed to importing that package separately of the API, and utilizing those methods manually.

Or simple a wrapper method for them, to generate the bearer so you can supply it to the ACLLoginParams parameter of `Login`.

#### Use Case(s)

Any type of usage of the consul API package where AWS auth is in play in the cluster will benefit from this.

It is also beneficial when writing wrappers around the consul CLI in a Developer Experience environment, to simplify the usage of the consul CLI for those developers utilizing a consul platform, that may not be platform/system engineers themselves.

Contributor guide

Open the contributing guide

Research direction

Start with ACL.Login and ACLLoginParams in the Consul API SDK, then compare their behavior with the AWS authentication methods in command/login/aws.go. Clarify whether the SDK should accept an AwsAuth flag or expose a bearer-generation wrapper. Done means AWS-authenticated API SDK login can obtain the SigV4 bearer without requiring callers to import the CLI package.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
api, authentication, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.