Skip to content

feat(auth): add AWS security credentials supplier support#5595

Open
Linkgoron wants to merge 2 commits into
googleapis:mainfrom
Linkgoron:feat-auth-aws-security-credentials-supplier
Open

feat(auth): add AWS security credentials supplier support#5595
Linkgoron wants to merge 2 commits into
googleapis:mainfrom
Linkgoron:feat-auth-aws-security-credentials-supplier

Conversation

@Linkgoron
Copy link
Copy Markdown

This PR adds a programmatic AWS external account builder that accepts caller-provided AWS region and security credentials. This lets applications delegate AWS credential resolution to the AWS SDK while google-cloud-auth builds the AWS subject token and performs the Google token exchange.

This, hopefully, adds similar behavior to the ones that already exist in the Go, Python or Node SDKs.

Also add supplier-path tests and censor sensitive AWS credential fields in Debug output.

@Linkgoron Linkgoron requested review from a team as code owners May 6, 2026 07:23
@google-cla
Copy link
Copy Markdown

google-cla Bot commented May 6, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces support for AWS Workload Identity Federation by adding the AwsSecurityCredentialsSupplier trait and the AwsExternalAccountBuilder. It refactors the existing AWS credential resolution logic to support custom suppliers and includes new tests for these features. Review feedback suggests deriving Debug for the new builder to maintain consistency with repository style guides and recommends addressing an inconsistency in ProgrammaticBuilder regarding universe_domain handling.

Comment thread src/auth/src/credentials/external_account.rs Outdated
Comment thread src/auth/src/credentials/external_account.rs
@Linkgoron Linkgoron force-pushed the feat-auth-aws-security-credentials-supplier branch 2 times, most recently from f11f06e to 92c92ec Compare May 12, 2026 07:06
@Linkgoron Linkgoron force-pushed the feat-auth-aws-security-credentials-supplier branch 3 times, most recently from ffd50b3 to 69d4d23 Compare May 20, 2026 07:08
@dbolduc
Copy link
Copy Markdown
Member

dbolduc commented May 21, 2026

Hey, thanks for the PR. It is probably correct, but we will need some time before we are able to look at it.

  • This feature isn't part of our planning cycle.
  • External credentials are hard to verify. We will need to invest some time in setting up a test environment.

In the meantime, you can ask your technical account manager / customer engineer for this feature to help us prioritize the work.

Linkgoron and others added 2 commits May 27, 2026 12:51
Add a programmatic AWS external account builder that accepts caller-provided AWS region and security credentials. This lets applications delegate AWS credential resolution to the AWS SDK while google-cloud-auth builds the AWS subject token and performs the Google token exchange.

Also add supplier-path tests and censor sensitive AWS credential fields in Debug output.
@Linkgoron Linkgoron force-pushed the feat-auth-aws-security-credentials-supplier branch from 69d4d23 to 05836dc Compare May 27, 2026 18:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants