sia

README

SIA for AWS Fargate

Configuration

SIA AWS Fargate requires a configuration file to be present in the /etc/sia/sia_config with the following required attributes:

{
    "version": "1.0.0",
    "service": "application-service-name",
    "accounts": [
        {
            "domain":  "application-domain-name",
            "account": "application-account-aws-id"
        }
    ]
}

The AWS Account administrator must create an IAM Role called <application-domain-name>.<application-service-name> and this role must be setup with a trusted relationship with the role that the Fargate task is configured to run as. ( most likely Task Role )

SIA Configuration file provides a way to change the default user/group settings that the private key is owned by. By default, the private key is owned by user root and readable by group athenz. If the user wants to provide access to their service identity private key to another user, it can be accomplished by adding the user to the group athenz. If the user wants to change the user and group values, a config file must be dropped with the following optional fields:

{
    "version": "1.0.0",
    "service": "application-service-name",
    "accounts": [
        {
            "domain":  "application-domain-name",
            "account": "application-account-aws-id",
            "user": "unix-username",
            "group": "unix-groupname"
        }
    ]
}

SIA-Fargate can be built with following parameters - e.g.

GOOS=linux go install -ldflags "-X main.Version=1.0.0 -X main.ZtsEndPoint=zts.athenz.io -X main.DnsDomain=aws.athenz.cloud -X main.ProviderPrefix=athenz.aws" ./...

alternatively, those parameters can be passed during runtime and runtime parameters will take precedence over build time parameters.

Documentation

Index

• func GetFargateConfig(configFile, metaEndpoint string, useRegionalSTS bool, account, region string) (*options.Config, *options.ConfigAccount, error)
• func GetFargateData(metaEndPoint string) (string, string, string, error)
• type FargateProvider
  • func (fargate FargateProvider) AttestationData(svc string, key crypto.PrivateKey, sigInfo *signature.SignatureInfo) (string, error)
  • func (eks FargateProvider) CloudAttestationData(base, svc, ztSserverName string) (string, error)
  • func (tp FargateProvider) GetAccessManagementProfileFromMeta(base string) (string, error)
  • func (eks FargateProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)
  • func (tp FargateProvider) GetAdditionalSshHostPrincipals(base string) (string, error)
  • func (fargate FargateProvider) GetCsrDn() pkix.Name
  • func (fargate FargateProvider) GetEmail(service string) []string
  • func (fargate FargateProvider) GetHostname(fqdn bool) string
  • func (fargate FargateProvider) GetName() string
  • func (fargate FargateProvider) GetRoleDnsNames(cert *x509.Certificate, service string) []string
  • func (fargate FargateProvider) GetSanDns(service string, includeHost bool, wildcard bool, cnames []string) []string
  • func (fargate FargateProvider) GetSanIp(docIp map[string]bool, ips []net.IP, opts ip.Opts) []net.IP
  • func (fargate FargateProvider) GetSanUri(svc string, opts ip.Opts, spiffeTrustDomain, spiffeNamespace string) []*url.URL
  • func (fargate FargateProvider) GetSuffix() string
  • func (fargate FargateProvider) PrepareKey(file string) (crypto.PrivateKey, error)

Functions

func GetFargateConfig

func GetFargateConfig(configFile, metaEndpoint string, useRegionalSTS bool, account, region string) (*options.Config, *options.ConfigAccount, error)

func GetFargateData

func GetFargateData(metaEndPoint string) (string, string, string, error)

Types

type FargateProvider

type FargateProvider struct {
	Name string
}

func (FargateProvider) AttestationData

func (fargate FargateProvider) AttestationData(svc string, key crypto.PrivateKey, sigInfo *signature.SignatureInfo) (string, error)

func (FargateProvider) CloudAttestationData

func (eks FargateProvider) CloudAttestationData(base, svc, ztSserverName string) (string, error)

func (FargateProvider) GetAccessManagementProfileFromMeta

func (tp FargateProvider) GetAccessManagementProfileFromMeta(base string) (string, error)

func (FargateProvider) GetAccountDomainServiceFromMeta

func (eks FargateProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)

func (FargateProvider) GetAdditionalSshHostPrincipals

func (tp FargateProvider) GetAdditionalSshHostPrincipals(base string) (string, error)

func (FargateProvider) GetCsrDn

func (fargate FargateProvider) GetCsrDn() pkix.Name

func (FargateProvider) GetEmail

func (fargate FargateProvider) GetEmail(service string) []string

func (FargateProvider) GetHostname

func (fargate FargateProvider) GetHostname(fqdn bool) string

GetHostname returns the hostname as per the provider

func (FargateProvider) GetName

func (fargate FargateProvider) GetName() string

GetName returns the name of the current provider

func (FargateProvider) GetRoleDnsNames

func (fargate FargateProvider) GetRoleDnsNames(cert *x509.Certificate, service string) []string

func (FargateProvider) GetSanDns

func (fargate FargateProvider) GetSanDns(service string, includeHost bool, wildcard bool, cnames []string) []string

func (FargateProvider) GetSanIp

func (fargate FargateProvider) GetSanIp(docIp map[string]bool, ips []net.IP, opts ip.Opts) []net.IP

func (FargateProvider) GetSanUri

func (fargate FargateProvider) GetSanUri(svc string, opts ip.Opts, spiffeTrustDomain, spiffeNamespace string) []*url.URL

func (FargateProvider) GetSuffix

func (fargate FargateProvider) GetSuffix() string

func (FargateProvider) PrepareKey

func (fargate FargateProvider) PrepareKey(file string) (crypto.PrivateKey, error)