Skip to content

Commit 822afc0

Browse files
daniel-codefreshdaniel-codefresh
authored
added oidc steps: 1.obtain oidc id token. 2.aws sts assume role (#643)
Signed-off-by: Daniel Soifer <[email protected]>
1 parent c6cf6a8 commit 822afc0

File tree

4 files changed

+237
-0
lines changed

4 files changed

+237
-0
lines changed

‎incubating/aws-sts-assume-role-with-web-identity/icon.svg

Lines changed: 1 addition & 0 deletions
Loading

‎incubating/aws-sts-assume-role-with-web-identity/step.yaml

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
version: '1.0'
2+
kind: step-type
3+
metadata:
4+
version: 1.0.0
5+
name: aws-sts-assume-role-with-web-identity
6+
description: >-
7+
Obtain AWS STS credentials using OIDC ID token and export them as environment variables
8+
isPublic: true
9+
latest: true
10+
official: true
11+
stage: incubating
12+
sources:
13+
- 'https://github.com/codefresh-io/steps/tree/master/incubating/aws-sts-assume-role-with-web-identity'
14+
maintainers:
15+
- name: Daniel Soifer
16+
categories:
17+
- oidc
18+
tags: [
19+
'aws',
20+
'sts',
21+
'oidc',
22+
'open id connect',
23+
'id token'
24+
]
25+
icon:
26+
type: svg
27+
url: https://raw.githubusercontent.com/codefresh-io/steps/master/incubating/aws-sts-assume-role-with-web-identity/icon.svg
28+
background: '#f4f4f4'
29+
examples:
30+
- description: example-with-obtain-oidc-id-token-step
31+
workflow:
32+
version: '1.0'
33+
steps:
34+
obtain_id_token:
35+
title: Obtain ID Token
36+
type: obtain-oidc-id-token
37+
assume_role:
38+
title: Assume Role
39+
type: aws-sts-assume-role-with-web-identity
40+
arguments:
41+
ROLE_ARN: arn:aws:iam::123456789012:role/role-name
42+
ROLE_SESSION_NAME: session-name
43+
s3_list_objects:
44+
title: List S3 Objects
45+
image: amazon/aws-cli
46+
commands:
47+
- aws s3 ls "s3://bucket-name/"
48+
- description: example-with-id-token-from-environment-variable
49+
workflow:
50+
version: '1.0'
51+
steps:
52+
assume_role:
53+
title: Assume Role
54+
type: aws-sts-assume-role-with-web-identity
55+
arguments:
56+
ROLE_ARN: arn:aws:iam::123456789012:role/role-name
57+
ROLE_SESSION_NAME: session-name
58+
WEB_IDENTITY_TOKEN: ${{ID_TOKEN}}
59+
s3_list_objects:
60+
title: List S3 Objects
61+
image: amazon/aws-cli
62+
commands:
63+
- aws s3 ls "s3://bucket-name/"
64+
spec:
65+
arguments: |-
66+
{
67+
"definitions": {},
68+
"$schema": "http://json-schema.org/draft-07/schema#",
69+
"type": "object",
70+
"additionalProperties": false,
71+
"patterns": [],
72+
"required": [
73+
"ROLE_ARN",
74+
"ROLE_SESSION_NAME"
75+
],
76+
"properties": {
77+
"ROLE_ARN": {
78+
"type": "string",
79+
"description": "the ARN of the role to assume"
80+
},
81+
"ROLE_SESSION_NAME": {
82+
"type": "string",
83+
"description": "the name of the session"
84+
},
85+
"WEB_IDENTITY_TOKEN": {
86+
"type": "string",
87+
"description": "the OIDC ID token. If not provided, the step will try to read it from the environment variable ID_TOKEN (which is set by the obtain-oidc-id-token step)"
88+
}
89+
}
90+
}
91+
returns: |-
92+
{
93+
"definitions": {},
94+
"$schema": "http://json-schema.org/draft-07/schema#",
95+
"type": "object",
96+
"additionalProperties": true,
97+
"patterns": [],
98+
"required": [
99+
"AWS_ACCESS_KEY_ID",
100+
"AWS_SECRET_ACCESS_KEY",
101+
"AWS_SESSION_TOKEN"
102+
],
103+
"properties": {
104+
"AWS_ACCESS_KEY_ID": {
105+
"type": "string",
106+
"description": "the AWS access key id"
107+
},
108+
"AWS_SECRET_ACCESS_KEY": {
109+
"type": "string",
110+
"description": "the AWS secret access key"
111+
},
112+
"AWS_SESSION_TOKEN": {
113+
"type": "string",
114+
"description": "the AWS session token"
115+
}
116+
}
117+
}
118+
delimiters:
119+
left: '[['
120+
right: ']]'
121+
stepsTemplate: |-
122+
main:
123+
name: aws-sts-assume-role-with-web-identity
124+
image: mikesir87/aws-cli
125+
environment:
126+
[[ range $key, $val := .Arguments ]]
127+
- '[[ $key ]]=[[ $val ]]'
128+
[[- end ]]
129+
- 'ID_TOKEN=${{ID_TOKEN}}'
130+
commands:
131+
- |
132+
[[- if .Arguments.WEB_IDENTITY_TOKEN ]]
133+
TOKEN=$WEB_IDENTITY_TOKEN
134+
[[- else ]]
135+
TOKEN=$ID_TOKEN
136+
[[- end ]]
137+
138+
SESSION_CREDS=$(aws sts assume-role-with-web-identity \
139+
--role-arn "$ROLE_ARN" \
140+
--role-session-name "$ROLE_SESSION_NAME" \
141+
--web-identity-token "$TOKEN" \
142+
--output json \
143+
--query Credentials)
144+
145+
AWS_ACCESS_KEY_ID=$(echo "$SESSION_CREDS" | jq -r .AccessKeyId)
146+
AWS_SECRET_ACCESS_KEY=$(echo "$SESSION_CREDS" | jq -r .SecretAccessKey)
147+
AWS_SESSION_TOKEN=$(echo "$SESSION_CREDS" | jq -r .SessionToken)
148+
149+
cf_export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID --mask
150+
cf_export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY --mask
151+
cf_export AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN --mask

‎incubating/obtain-oidc-id-token/icon.svg

Lines changed: 1 addition & 0 deletions
Loading

‎incubating/obtain-oidc-id-token/step.yaml

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
version: '1.0'
2+
kind: step-type
3+
metadata:
4+
version: 1.0.0
5+
name: obtain-oidc-id-token
6+
description: >-
7+
Obtain ID token from Codefresh OIDC Provider
8+
isPublic: true
9+
latest: true
10+
official: true
11+
stage: incubating
12+
sources:
13+
- 'https://github.com/codefresh-io/steps/tree/master/incubating/obtain-oidc-id-token'
14+
maintainers:
15+
- name: Daniel Soifer
16+
categories:
17+
- oidc
18+
tags: [
19+
'oidc',
20+
'open id connect',
21+
'id token'
22+
]
23+
icon:
24+
type: svg
25+
url: https://raw.githubusercontent.com/codefresh-io/steps/master/incubating/obtain-oidc-id-token/icon.svg
26+
background: '#f4f4f4'
27+
examples:
28+
- description: example-with-print-output
29+
workflow:
30+
version: '1.0'
31+
steps:
32+
obtain_id_token:
33+
title: Obtain ID Token
34+
type: obtain-oidc-id-token
35+
print_output:
36+
title: Printing output from previous step
37+
image: alpine
38+
commands:
39+
- echo $ID_TOKEN
40+
- echo ${{steps.obtain_id_token.output.ID_TOKEN}}
41+
- description: example-with-aws-sts-assume-role-step
42+
workflow:
43+
version: '1.0'
44+
steps:
45+
obtain_id_token:
46+
title: Obtain ID Token
47+
type: obtain-oidc-id-token
48+
assume_role:
49+
title: Assume Role
50+
type: aws-sts-assume-role-with-web-identity
51+
arguments:
52+
ROLE_ARN: arn:aws:iam::123456789012:role/role-name
53+
ROLE_SESSION_NAME: session-name
54+
s3_list_objects:
55+
title: List S3 Objects
56+
image: amazon/aws-cli
57+
commands:
58+
- aws s3 ls "s3://bucket-name/"
59+
spec:
60+
returns: |-
61+
{
62+
"definitions": {},
63+
"$schema": "http://json-schema.org/draft-07/schema#",
64+
"type": "object",
65+
"additionalProperties": true,
66+
"patterns": [],
67+
"required": [
68+
"ID_TOKEN"
69+
],
70+
"properties": {
71+
"ID_TOKEN": {
72+
"type": "string",
73+
"description": "the ID token obtained from Codefresh OIDC Provider"
74+
}
75+
}
76+
}
77+
steps:
78+
main:
79+
name: obtain-oidc-id-token
80+
image: dwdraju/alpine-curl-jq
81+
commands:
82+
- |
83+
ID_TOKEN=$(curl -H "Authorization: $CF_OIDC_REQUEST_TOKEN" "$CF_OIDC_REQUEST_URL" | jq -r ".id_token")
84+
cf_export ID_TOKEN=$ID_TOKEN --mask

0 commit comments

Comments
 (0)