Allow the S3 credentials for a domain to come from a AWS Token Service
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 598
- Forks
- 168
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 86
Description
On our deployment we store S3 bucket credentials in another service and they can't be handed to Pulp directly in all cases.
What can be done is those other services can hand Pulp a token which can be used to act on behalf of a user who does have access to those services. To do that they use the AWS Token Service.
How could Pulp use a token like that to configure django-storages?
How to configure Pulp to fetch the tokens is not something I have a good idea on yet, but let's assume we already have the token. Then Pulp could:
- Here's an example of another project that uses STS to configure Boto.
- The django-storages docs say we can use a Boto session to configure django-storages.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Koku provider.py example and the django-storages Amazon S3 authentication settings. Determine how an AWS STS token could configure a Boto session for django-storages; the issue does not define how Pulp should obtain tokens, so that design remains part of the work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, django, python
- Domain
- backend, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100