idaas-go-akless-aws-adapter

README

idaas-go-akless-aws-adapter

简体中文 | English

Go SDK for IDaaS (Identity as a Service) AKless AWS Adapter — Enables AK-free authentication for AWS services using IDaaS PAM (Privileged Access Management) to obtain AWS STS temporary credentials.

How It Works

┌──────────┐    OIDC Token    ┌──────────────┐   AWS STS Credentials   ┌─────────────┐
│  IDaaS   │ ──────────────►  │  PAM          │ ──────────────────────► │  AWS        │
│  Core    │                  │  Developer    │   (AccessKeyId,         │  Service    │
│  SDK     │                  │  API          │    SecretAccessKey,     │  (S3, etc.) │
└──────────┘                  └──────────────┘    SessionToken)         └─────────────┘

1. The IDaaS Core SDK obtains an OIDC Token via machine-to-machine authentication
2. This adapter sends the OIDC Token to the PAM Developer API to obtain AWS STS temporary credentials
3. The temporary credentials are used to authenticate with AWS services (S3, DynamoDB, Lambda, EC2, SQS, etc.)
4. Credentials are automatically cached and refreshed before expiration (dynamic prefetch at 1/3 remaining lifetime)

Features

• AK-free Authentication: Uses OIDC Token to obtain AWS STS temporary credentials via IDaaS PAM
• AWS SDK Compatible: Implements aws.CredentialsProvider interface, can be used directly with all AWS SDK Go v2 service clients
• Automatic Credential Refresh: Built-in credential caching via Core SDK CachedResultSupplier with dynamic prefetch
• Customizable Timeouts: Supports separate connect and read timeout configuration
• Simple Integration: Factory function provides one-line creation of credential providers

Requirements

• Go >= 1.25
• Dependencies:
  • github.com/cloud-idaas/idaas-go-core-sdk
  • github.com/aws/aws-sdk-go-v2

Installation

go get github.com/cloud-idaas/idaas-go-akless-aws-adapter

Prerequisites

This SDK depends on idaas-go-core-sdk. You need to complete the IDaaS Core SDK initialization before using this adapter.

1. Add and configure idaas-go-core-sdk, refer to idaas-go-core-sdk README for details.

2. In the configuration file, set the scope to the IDaaS built-in scope for PAM:

   {
       "scope": "urn:cloud:idaas:pam|.all"
   }
   

3. Complete the IDaaS Core SDK initialization:

   import (
       idaasconfig "github.com/cloud-idaas/idaas-go-core-sdk/config"
       "github.com/cloud-idaas/idaas-go-core-sdk/factory"
   )
   
   cfg, err := idaasconfig.NewConfigReader().LoadWithPriority("")
   if err != nil {
       log.Fatalf("Failed to load IDaaS config: %v", err)
   }
   if err := factory.GetInstance().Initialize(cfg); err != nil {
       log.Fatalf("Failed to initialize IDaaS: %v", err)
   }
   

Quick Start

package main

import (
    "context"
    "fmt"
    "log"

    "github.com/cloud-idaas/idaas-go-akless-aws-adapter/pam"
    idaasconfig "github.com/cloud-idaas/idaas-go-core-sdk/config"
    "github.com/cloud-idaas/idaas-go-core-sdk/factory"
    awsconfig "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/s3"
)

func main() {
    // 1. Initialize IDaaS Core SDK
    idaasCfg, err := idaasconfig.NewConfigReader().LoadWithPriority("")
    if err != nil {
        log.Fatalf("Failed to load IDaaS config: %v", err)
    }
    if err := factory.GetInstance().Initialize(idaasCfg); err != nil {
        log.Fatalf("Failed to initialize IDaaS: %v", err)
    }

    // 2. Create AWS credentials provider
    awsProvider, err := pam.GetAwsCredentialsProvider("your-role-arn")
    if err != nil {
        log.Fatalf("Failed to create provider: %v", err)
    }

    // 3. Create AWS SDK config with IDaaS credentials
    cfg, err := awsconfig.LoadDefaultConfig(context.TODO(),
        awsconfig.WithCredentialsProvider(awsProvider),
        awsconfig.WithRegion("us-east-1"),
    )
    if err != nil {
        log.Fatalf("Failed to load config: %v", err)
    }

    // 4. Use any AWS service
    s3Client := s3.NewFromConfig(cfg)
    output, _ := s3Client.ListBuckets(context.TODO(), &s3.ListBucketsInput{})
    for _, bucket := range output.Buckets {
        fmt.Println(*bucket.Name)
    }
}

API Reference

Factory

Function	Return Type	Description
pam.GetAwsCredentialsProvider(roleArn)	(*IDaaSPamAwsCredentialsProvider, error)	Creates a provider using Core SDK Factory configuration

IDaaSPamAwsCredentialsProvider

Method	Return Type	Description
Retrieve(ctx)	(aws.Credentials, error)	Implements aws.CredentialsProvider. Returns cached credentials, auto-refreshes if expired
GetCredentials()	(*domain.AwsStsCredential, error)	Returns the raw STS credential for custom use
GetRoleArn()	string	Returns the configured role ARN
GetOIDCToken()	string	Returns the last used OIDC token
GetIdaasInstanceId()	string	Returns the IDaaS instance ID
GetDeveloperApiEndpoint()	string	Returns the Developer API endpoint
GetConnectTimeout()	int	Returns the connect timeout (ms)
GetReadTimeout()	int	Returns the read timeout (ms)

Constructor (Advanced)

provider, err := pam.NewIDaaSPamAwsCredentialsProvider(
    pam.WithOidcTokenProvider(oidcTokenProvider),
    pam.WithDeveloperApiEndpoint("https://your-pam-endpoint.example.com"),
    pam.WithIdaasInstanceId("your-instance-id"),
    pam.WithRoleArn("your-role-arn"),
    pam.WithConnectTimeout(5000),  // optional, default 5000ms
    pam.WithReadTimeout(10000),    // optional, default 10000ms
)

Environment Variables

Variable	Description
CLOUD_IDAAS_CONFIG_PATH	Path to the IDaaS configuration file. Defaults to cloud_idaas.json in the current directory
IDAAS_CLIENT_SECRET	Client secret for IDaaS authentication. Recommended over storing secrets in the config file

Support and Feedback

• Email: cloudidaas@list.alibaba-inc.com
• Issues: Submit an Issue

License

This project is licensed under the Apache License 2.0.