oxidecomputer / oxidecomputer/buildomat
support OpenID Connect (OIDC) for delegated AWS authentication
@jclulow is already working on this.
Since Mar 30, 2023.
- Dominant language
- Rust
- Stars
- 72
- Forks
- 5
- PR merge metrics
- No merged PRs in 30d
Description
Amazon allows an OpenID Connect provider to generate access tokens that will map to a particular preconfigured set of IAM rights.
In this model, buildomat would be an OIDC provider that one could configure in their AWS account. When requested by the job, we would generate ephemeral OIDC tokens that identify the specific buildomat account (which maps 1:1 with a GitHub repository in most cases) and AWS would allow that authentication to assume a role and get an ephemeral AWS access token and secret key and so on. This would avoid the need for general secret storage.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.