Add AWS Automation from Consul CLI to Consul API SDK
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
#### Feature Description
Currently, performing `consul login -type aws-iam`, under the hood the consul cli performs the AWS authentication generating the sig v4 bearer token to send to the consul server for validation to obtain a consul token.
The `Login` method in the [API SDK](https://pkg.go.dev/github.com/hashicorp/consul/api#ACL.Login) requires a bearer be provided, and does not leverage the aws automation if you're using an aws authentication method.
A `bool` for `AwsAuth` in the [ACLLoginParams](https://pkg.go.dev/github.com/hashicorp/consul/api#ACLLoginParams) struct to denote this, so the bearer can be retrieved via the methods in the AWS section of the [Login Package](https://github.com/hashicorp/consul/blob/main/command/login/aws.go) of command can be leveraged for this, as opposed to importing that package separately of the API, and utilizing those methods manually.
Or simple a wrapper method for them, to generate the bearer so you can supply it to the ACLLoginParams parameter of `Login`.
#### Use Case(s)
Any type of usage of the consul API package where AWS auth is in play in the cluster will benefit from this.
It is also beneficial when writing wrappers around the consul CLI in a Developer Experience environment, to simplify the usage of the consul CLI for those developers utilizing a consul platform, that may not be platform/system engineers themselves.
Contributor guide
Research direction
Start with ACL.Login and ACLLoginParams in the Consul API SDK, then compare their behavior with the AWS authentication methods in command/login/aws.go. Clarify whether the SDK should accept an AwsAuth flag or expose a bearer-generation wrapper. Done means AWS-authenticated API SDK login can obtain the SigV4 bearer without requiring callers to import the CLI package.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- api, authentication, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100