{"repo":"alliander-opensource/aws-jwt-sts","free":true,"listed":false,"github":"https://github.com/alliander-opensource/aws-jwt-sts","clone":"git clone https://github.com/alliander-opensource/aws-jwt-sts.git","description":"AWS STS function to exchange AWS IAM credentials for a JWT","language":"TypeScript","stars":10,"topics":["aws","jwt","oidc","sts","awscdk"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"Use IAM roles to authenticate principals in workloads outside of AWS using JWT There is an inherent risk in maintaining and storing permanent credentials. In their lifetime, they are bound to be shared, compromised, and lost. When shared, it is often among a broader audience than initially intended. They can also be lost and found, sometimes by the wrong person. And when any of this occurs, it can put your systems, data or even organization at risk. Workloads running on AWS can communicate with each other or with AWS services without the need of storing permanent credentials by assuming roles or instance profiles. However, if one of the workloads lives outside of AWS, AWS principals can no longer be used for authentication. An alternative to authenticating with external workloads is to use short-lived credentials issued by a trusted party, the issuer, that the target system can accept. JWTs (JSON Web Tokens), as used by the OIDC (OpenID Connect) standard, are an example of such credentials. JWTs are short-lived credentials that can be signed and verified using a public key in what is known as public-key cryptography. Secure Token Service (STS) Exchanging credentials from on form to the other is done with a Secure Token Service (STS) function. AWS also provides STS functions not the one we need. Only the other way around: to exchange a JWT to IAM Session which is called AssumeRoleWithWebIdentity. This repo contains a CDK Construct which will deploy a new function which adds th","default_branch":null,"files":null,"tree":[],"storefront":"/r/alliander-opensource","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/alliander-opensource/aws-jwt-sts/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}