sia: lambda identity support for web identity tokens - #3451
Open
havetisyan wants to merge 1 commit into
Open
Conversation
Add GetAthenzServiceIdentity to the aws lambda sia library. It takes an AthenzIdentityRequest struct carrying all the attributes supported by the now deprecated GetAthenzIdentity method plus the ones required to fully support fetching identities based on either aws temporary credentials or web identity tokens: aws account, region, regional sts, omit domain, iam role path, instance id san dns, and the web identity audience, signing algorithm, duration and tags. The web identity implementation follows the CloudAttestationData handling in the ec2 provider - the audience defaults to the zts url, and the sia defaults of ES384 and 300 seconds are applied when not specified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enhances the Go AWS Lambda SIA library to support requesting Athenz X.509 service identity certificates using either (a) STS assume-role temporary credentials (existing behavior) or (b) AWS-issued OIDC web identity tokens (JWT), aligning Lambda support with the broader AWS SIA web identity attestation flow.
Changes:
- Added
GetAthenzServiceIdentity(*AthenzIdentityRequest)API with request fields covering both temp-credential and web-identity attestation inputs (including defaults for signing algorithm and duration). - Implemented attestation selection logic (
getAthenzAttestationData) to produce either temp-credential or web-identity attestation payloads. - Added comprehensive unit tests including a mock ZTS
/instanceendpoint and stubs for STS attestation/token fetching.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| libs/go/sia/aws/lambda/lambda.go | Introduces AthenzIdentityRequest and GetAthenzServiceIdentity with web identity token attestation support and sensible defaults. |
| libs/go/sia/aws/lambda/lambda_test.go | Adds new tests validating request validation, defaulting, temp-credential path, web-identity path, and ZTS error handling via a mock ZTS server. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add GetAthenzServiceIdentity to the aws lambda sia library. It takes an AthenzIdentityRequest struct carrying all the attributes supported by the now deprecated GetAthenzIdentity method plus the ones required to fully support fetching identities based on either aws temporary credentials or web identity tokens: aws account, region, regional sts, omit domain, iam role path, instance id san dns, and the web identity audience, signing algorithm, duration and tags.
The web identity implementation follows the CloudAttestationData handling in the ec2 provider - the audience defaults to the zts url, and the sia defaults of ES384 and 300 seconds are applied when not specified.
Description
Contribution Checklist:
Attach Screenshots (Optional)