conjur-api-go
conjur-api-go copied to clipboard
Add IAM authenticator
Rough POC for adding IAM authentication to the Go SDK.
NOTE: This depends on the AWS config existing on the system, which should be the case for any user of the AWS CLI or when running on ec2 or lambda.
Usage example:
config := conjurapi.Config{
ApplianceURL: "http://localhost:3000",
Account: "cucumber",
AuthnType: "iam",
ServiceID: "aws",
HostID: "conjur/authn-iam/aws/production/578847545830/glen",
}
client, err := conjurapi.NewClientFromEnvironment(config)
if err != nil {
fmt.Println("Error creating Conjur client:", err)
return
}
resp, err := client.WhoAmI()
fmt.Println(string(resp))
Improvements:
- Add tests
- If configured host ID doesn't match the AWS config, we could attempt to assume the AWS role and fetch temporary credentials like so:
svc := sts.NewFromConfig(cfg)
credsProvider := stscreds.NewAssumeRoleProvider(svc, "arn:aws:iam::578847545830:role/MyAppRole")
credentials, err := credsProvider.Retrieve(ctx)
if err != nil {
fmt.Println("Error retrieving credentials:", err)
return nil
}
return &credentials