Sigv4: Use externalId when signing with sigv4 (#238)

---------

Co-authored-by: Isabella Siu <[email protected]>

Author: idastambuk

pkg/sigv4/sigv4.go

@@ -27,6 +27,8 @@ import (
 
 var (
 	signerCache sync.Map
+	newStsCreds = stscreds.NewCredentials
+	newV4Signer = v4.NewSigner
 )
 
 type middleware struct {
@@ -235,10 +237,10 @@ func createSigner(cfg *Config, authSettings awsds.AuthSettings, verboseMode bool
 			if err != nil {
 				return nil, err
 			}
-			c = stscreds.NewCredentials(s, cfg.AssumeRoleARN)
+			return getAssumeRoleSigner(s, cfg, signerOpts)
 		}
 
-		return v4.NewSigner(c, signerOpts), nil
+		return newV4Signer(c, signerOpts), nil
 	case awsds.AuthTypeDefault:
 		s, err := session.NewSession(&aws.Config{
 			Region: aws.String(cfg.Region),
@@ -248,10 +250,10 @@ func createSigner(cfg *Config, authSettings awsds.AuthSettings, verboseMode bool
 		}
 
 		if cfg.AssumeRoleARN != "" {
-			return v4.NewSigner(stscreds.NewCredentials(s, cfg.AssumeRoleARN), signerOpts), nil
+			return getAssumeRoleSigner(s, cfg, signerOpts)
 		}
 
-		return v4.NewSigner(s.Config.Credentials, signerOpts), nil
+		return newV4Signer(s.Config.Credentials, signerOpts), nil
 	default:
 		if cfg.AssumeRoleARN != "" {
 			s, err := session.NewSession(&aws.Config{
@@ -260,7 +262,7 @@ func createSigner(cfg *Config, authSettings awsds.AuthSettings, verboseMode bool
 			if err != nil {
 				return nil, err
 			}
-			return v4.NewSigner(stscreds.NewCredentials(s, cfg.AssumeRoleARN), signerOpts), nil
+			return getAssumeRoleSigner(s, cfg, signerOpts)
 		}
 		return nil, fmt.Errorf("invalid SigV4 auth type %q", authType)
 	}
@@ -273,10 +275,19 @@ func createSigner(cfg *Config, authSettings awsds.AuthSettings, verboseMode bool
 		if err != nil {
 			return nil, err
 		}
-		return v4.NewSigner(stscreds.NewCredentials(s, cfg.AssumeRoleARN), signerOpts), nil
+		return getAssumeRoleSigner(s, cfg, signerOpts)
 	}
 
-	return v4.NewSigner(c, signerOpts), nil
+	return newV4Signer(c, signerOpts), nil
+}
+
+func getAssumeRoleSigner(s *session.Session, cfg *Config, signerOpts func(s *v4.Signer)) (*v4.Signer, error) {
+	if cfg.ExternalID != "" {
+		return newV4Signer(newStsCreds(s, cfg.AssumeRoleARN, func(p *stscreds.AssumeRoleProvider) {
+			p.ExternalID = aws.String(cfg.ExternalID)
+		}), signerOpts), nil
+	} 
+	return newV4Signer(newStsCreds(s, cfg.AssumeRoleARN), signerOpts), nil
 }
 
 func copyHeaderWithoutOverwrite(dst, src http.Header) {

pkg/sigv4/sigv4_test.go

@@ -10,7 +10,9 @@ import (
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 	"github.com/grafana/grafana-plugin-sdk-go/backend/log"
 
+	"github.com/aws/aws-sdk-go/aws/client"
 	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
 	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
 
 	"github.com/stretchr/testify/require"
@@ -301,6 +303,71 @@ func TestConfig(t *testing.T) {
 	})
 }
 
+func TestCreateSigner_UsesExternalID_WhenProvided(t *testing.T) {
+	for _, tc := range []struct {
+		authType string
+	}{
+		{authType: "default"},
+		{authType: "credentials"},
+		{authType: "keys"},
+		{authType: "ec2_iam_role"},
+		{authType: "grafana_assume_role"},
+	} {
+		t.Run(fmt.Sprintf("AuthType: %s", tc.authType), func(t *testing.T) {
+			// Capture the external ID passed into the AssumeRoleProvider
+			var capturedExternalID string
+			var signerCalled bool
+
+			// Mock stscreds.NewCredentials
+			newStsCreds = func(c client.ConfigProvider, arn string, optFns ...func(*stscreds.AssumeRoleProvider)) *credentials.Credentials {
+				provider := &stscreds.AssumeRoleProvider{}
+				for _, opt := range optFns {
+					opt(provider)
+				}
+				if provider.ExternalID != nil {
+					capturedExternalID = *provider.ExternalID
+				}
+				return credentials.NewStaticCredentials("mock-access", "mock-secret", "mock-token")
+			}
+
+			// Mock v4.NewSigner
+			newV4Signer = func(creds *credentials.Credentials, opts ...func(s *v4.Signer)) *v4.Signer {
+				signerCalled = true
+				return &v4.Signer{}
+			}
+
+			// Restore mocks
+			defer func() {
+				newStsCreds = stscreds.NewCredentials
+				newV4Signer = v4.NewSigner
+			}()
+
+			cfg := &Config{
+				Region:        "us-east-2",
+				AuthType:      tc.authType,
+				AssumeRoleARN: "arn:aws:iam::123456789:role/test-role",
+				ExternalID:    "external-id-123",
+			}
+
+			signer, err := createSigner(cfg, awsds.AuthSettings{
+				AllowedAuthProviders: []string{
+					"default",
+					"credentials",
+					"keys",
+					"ec2_iam_role",
+					"grafana_assume_role",
+				},
+				AssumeRoleEnabled: true,
+			}, false)
+
+			require.NoError(t, err)
+			require.NotNil(t, signer)
+			require.True(t, signerCalled)
+			require.Equal(t, "external-id-123", capturedExternalID)
+		})
+	}
+}
+
 type mockCredentialsProvider struct {
 	credentials.Provider
 	noCredentials bool