support cross-account role assumption in dynamodb-stream-consumer#39
Merged
support cross-account role assumption in dynamodb-stream-consumer#39
Conversation
Add AWS_ASSUME_ROLE_ARN env var. When set, the service assumes the specified role via STS after loading base credentials, enabling cross-account DynamoDB Streams access in production. Issue: LFXV2-1094 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Jordan Evans <jevans@linuxfoundation.org>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds support for cross-account IAM role assumption in the DynamoDB stream consumer service. When the AWS_ASSUME_ROLE_ARN environment variable is set, the service uses AWS STS to assume the specified role after loading base credentials, enabling secure cross-account DynamoDB Streams access.
Changes:
- Added AWS STS role assumption capability using AWS SDK v2's stscreds provider
- Introduced new
AWS_ASSUME_ROLE_ARNoptional configuration parameter - Updated documentation and Helm charts to support the new feature
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| go.mod | Promoted AWS SDK v2 packages (sts, credentials/stscreds) from indirect to direct dependencies |
| cmd/dynamodb-stream-consumer/main.go | Added STS role assumption logic with lazy credential evaluation |
| cmd/dynamodb-stream-consumer/config.go | Added AssumeRoleARN field and environment variable loading |
| cmd/dynamodb-stream-consumer/README.md | Documented the new AWS_ASSUME_ROLE_ARN configuration option |
| charts/lfx-v1-sync-helper/values.yaml | Added AWS_ASSUME_ROLE_ARN environment variable configuration with example |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
andrest50
approved these changes
Feb 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add AWS_ASSUME_ROLE_ARN env var. When set, the service assumes the specified role via STS after loading base credentials, enabling cross-account DynamoDB Streams access in production.
Issue: LFXV2-1094