feat: add aws-signing-helper image

Author: denniseffing

apps/aws-signing-helper/Dockerfile

@@ -0,0 +1,27 @@
+FROM alpine:3.22.1
+
+ARG TARGETARCH
+ARG ARCH=${TARGETARCH/arm64/Aarch64}
+ARG ARCH=${ARCH/amd64/X86_64}
+ARG VERSION
+
+USER root
+WORKDIR /app
+
+RUN \
+    apk add --no-cache \
+        bash \
+        curl \
+        libc6-compat \
+        libgcc \
+    && mkdir -p /app/bin \
+    && curl -fsSL -o /tmp/aws-signing-helper "https://rolesanywhere.amazonaws.com/releases/${VERSION}/${ARCH}/Linux/aws_signing_helper" \
+    && mv -t /app/bin /tmp/aws-signing-helper \
+    && chown -R root:root /app && chmod -R 755 /app \
+    && rm -rf /tmp/*
+
+USER nobody:nogroup
+WORKDIR /config
+VOLUME ["/config"]
+
+ENTRYPOINT ["/usr/bin/catatonit", "--", "/entrypoint.sh"]

apps/aws-signing-helper/docker-bake.hcl

@@ -0,0 +1,42 @@
+target "docker-metadata-action" {}
+
+variable "APP" {
+  default = "aws-signing-helper"
+}
+
+variable "VERSION" {
+  // renovate: datasource=github-releases depName=aws/rolesanywhere-credential-helper
+  default = "1.7.0"
+}
+
+variable "SOURCE" {
+  default = "https://github.com/aws/rolesanywhere-credential-helper"
+}
+
+group "default" {
+  targets = ["image-local"]
+}
+
+target "image" {
+  inherits = ["docker-metadata-action"]
+  args = {
+    VERSION = "${VERSION}"
+  }
+  labels = {
+    "org.opencontainers.image.source" = "${SOURCE}"
+  }
+}
+
+target "image-local" {
+  inherits = ["image"]
+  output = ["type=docker"]
+  tags = ["${APP}:${VERSION}"]
+}
+
+target "image-all" {
+  inherits = ["image"]
+  platforms = [
+    "linux/amd64",
+    "linux/arm64"
+  ]
+}

apps/aws-signing-helper/entrypoint.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+if [[ -z "$TRUST_ANCHOR_ARN" ]]; then
+  echo "❌ Must provide TRUST_ANCHOR_ARN environment variable." 1>&2
+  exit 1
+fi
+
+if [[ -z "$PROFILE_ARN" ]]; then
+  echo "❌ Must provide PROFILE_ARN environment variable." 1>&2
+  exit 1
+fi
+
+if [[ -z "$ROLE_ARN" ]]; then
+  echo "❌ Must provide ROLE_ARN environment variable." 1>&2
+  exit 1
+fi
+
+echo "🚀 Starting IMDSv2 endpoint with aws_signing_helper ..."
+
+exec \
+    /app/bin/aws_signing_helper serve \
+      --certificate /iamra/tls.crt         \
+      --private-key /iamra/tls.key         \
+      --trust-anchor-arn $TRUST_ANCHOR_ARN \
+      --profile-arn $PROFILE_ARN           \
+      --role-arn $ROLE_ARN