jenkinsci / jenkinsci/aws-credentials-plugin
Support OIDC
- Dominant language
- Java
- Stars
- 30
- Forks
- 81
- PR merge metrics
- No merged PRs in 30d
Description
### What feature do you want to see added?
OIDC is a great way to get rotating credentials when working with AWS. Hard coding credentials is extremely frowned upon. In the case where Jenkins isn't hosted in AWS, but needs a set of credentials that do rotate, OIDC is an excellent way to do this.
This is what it looks like with github: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
I believe https://github.com/jenkinsci/aws-credentials-plugin/blob/master/src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AWSCredentialsImpl.java#L229 would need to take an argument, and possibly use https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/com/amazonaws/services/securitytoken/model/AssumeRoleWithWebIdentityRequest.html
The following plugin for jenkins leverages OIDC https://plugins.jenkins.io/oidc-provider/ but it seems not compatable with the aws cloud jenkins plugin
### Upstream changes
_No response_
Contributor guide
Research direction
Start with src/main/java/com/cloudbees/jenkins/plugins/awscredentials/AWSCredentialsImpl.java around line 229 and review AWS's AssumeRoleWithWebIdentityRequest documentation. Compare the proposed flow with Jenkins' oidc-provider plugin and determine the compatibility requirements; done means Jenkins can obtain rotating AWS credentials through OIDC without hard-coded credentials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- authentication, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100