{"repo":"shrikant-builds/gcp-aws-webidentityfederation","free":true,"listed":false,"github":"https://github.com/shrikant-builds/gcp-aws-webidentityfederation","clone":"git clone https://github.com/shrikant-builds/gcp-aws-webidentityfederation.git","description":"AWS Auth using WebIdentityFederation from Google Cloud","language":"Python","stars":16,"topics":["aws","sts","openid-connect","gcp","gcp-appengine-std","gcp-appengine-flex","jwt","oauth2"],"license":"MIT","category":"auth-billing-email","readme_excerpt":"Google Cloud to AWS authentication using Web Identity Federation This sample shows how to make authenticated calls to AWS APIs from Google Cloud Note in above picture S3 is just example service. You can call any AWS API that supports auth based on AWS STS credentials. In GCP KMS, Datastore, Memcache are just shown for illustration purpose to suggest caching credentials in case of high QPS services. Why use Web Identity Federation Based on OpenID Connect open standard Use cases Securely call AWS APIs from outside AWS environment like Google Cloud or your data center. Google Cloud to AWS Federation 1. Create a signed JWT using your system’s service account keys. This can be local operation or using Google Cloud signJWT API call (in case of GCP managed keys) 2. Make call to \"https://www.googleapis.com/oauth2/v4/token\" to exchange above token for Google signed token 3. Google should return you JWT which should look something like: 4. Make AWS STS WebIdentityFederation API call to retrieve temporary credentials \"https://sts.amazonaws.com/?DurationSeconds={DURATION}&Action=AssumeRoleWithWebIdentity&Version=2011-06-15&RoleSessionName={ROLE SESSION}&RoleArn={ROLE ARN}&WebIdentityToken={OPENIDTOKEN}\" Where ROLE SESSION = Temporary identifier for this session. Helps in tracking when analyzing Cloudtrail events ROLE ARN = ARN role created in setup step 2 above OPENIDTOKEN = Signed Token received from Google in prior step You get AWS temporary credentials from above call that can be used","default_branch":null,"files":null,"tree":[],"storefront":"/r/shrikant-builds","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/shrikant-builds/gcp-aws-webidentityfederation/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}