google-auth-library-python
google-auth-library-python copied to clipboard
googleapis
feat: add AWS container credential provider
The container credential provider is used on AWS ECS and AWS EKS. It presents a different API and integration surface than IMDS, and so custom code is required to make use of it.
Ref: https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html
Fixes #885. Fixes #1099.
One thing I wasn't sure about in this PR was reusing the url parameter, rendering it to have 2 different meanings. I'm happy to refactor it to a different name, but I'll leave that decision up to reviewers.
Can confirm we've tested with this and it works as expected. Thanks @mmalecki! Makes our lives way easier.
@BigTailWolf if you've got some time, this would unblock those of us trying to use ECS with google-auth in a big way. Right now, we're basically locked into using service account keys, and being able to use identity federation would be a huge step in securing our applications better. Thanks in advance!
Hey folks, we don't plan on directly supporting this right now and suggest using your own custom credential supplier.
@lsirac okay, thanks for the link, that seems pretty straightforward. I'll fully admit that's a little disappointing as it's something we'll have to incorporate in every repo we have that uses ECS, but I also totally understand y'all have to juggle your priorities.