synced/coder
1
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2025-07-03 16:13:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add AWS instance identity authentication (#570)

Browse Source 
* feat: Add AWS instance identity authentication

This allows zero-trust authentication for all AWS instances.

Prior to this, AWS instances could be used by passing `CODER_TOKEN`
as an environment variable to the startup script. AWS explicitly
states that secrets should not be passed in startup scripts because
it's user-readable.

* Fix sha256 verbosity

* Fix HTTP client being exposed on auth
This commit is contained in:
Kyle Carberry
2022-03-28 13:31:03 -06:00
committed by GitHub
parent 01957da040
commit a502a5fa14
13 changed files with 583 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
coderd/coderd.go
View File

@ -10,6 +10,7 @@ import (
"google.golang.org/api/idtoken"
"cdr.dev/slog"
"github.com/coder/coder/coderd/awsidentity"
"github.com/coder/coder/coderd/database"
"github.com/coder/coder/coderd/httpapi"
"github.com/coder/coder/coderd/httpmw"
@ -24,6 +25,7 @@ type Options struct {
Database database.Store
Pubsub database.Pubsub
AWSCertificates awsidentity.Certificates
GoogleTokenValidator *idtoken.Validator
}
@ -135,6 +137,7 @@ func New(options *Options) (http.Handler, func()) {
})
r.Route("/workspaceresources", func(r chi.Router) {
r.Route("/auth", func(r chi.Router) {
r.Post("/aws-instance-identity", api.postWorkspaceAuthAWSInstanceIdentity)
r.Post("/google-instance-identity", api.postWorkspaceAuthGoogleInstanceIdentity)
})
r.Route("/agent", func(r chi.Router) {