jenkinsci / jenkinsci/aws-credentials-plugin

Support OIDC

Open
#187 0 comments 8 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
30
Forks
81
PR merge metrics
No merged PRs in 30d

Description

### What feature do you want to see added?

OIDC is a great way to get rotating credentials when working with AWS. Hard coding credentials is extremely frowned upon. In the case where Jenkins isn't hosted in AWS, but needs a set of credentials that do rotate, OIDC is an excellent way to do this.

This is what it looks like with github: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services

I believe https://github.com/jenkinsci/aws-credentials-plugin/blob/master/src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AWSCredentialsImpl.java#L229 would need to take an argument, and possibly use https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/securitytoken/model/AssumeRoleWithWebIdentityRequest.html

The following plugin for jenkins leverages OIDC https://plugins.jenkins.io/oidc-provider/ but it seems not compatable with the aws cloud jenkins plugin

### Upstream changes

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AWSCredentialsImpl.java around line 229 and review AWS's AssumeRoleWithWebIdentityRequest documentation. Compare the proposed flow with Jenkins' oidc-provider plugin and determine the compatibility requirements; done means Jenkins can obtain rotating AWS credentials through OIDC without hard-coded credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, java
Domain
authentication, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.