[request]: Get temporary cloud credentials locally through Conveyor

[din14970]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request
It would be nice if the conveyor CLI could be used to request temporary access credentials to access cloud resources locally.

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?
We want to store data on an AWS S3 data lake. For the moment, Conveyor will only be used for a subset of compute jobs. Therefore, we need to be able to access the data lake on other systems, e.g. locally or on-prem compute clusters.

For access control on the data lake, we would like to implement something PBAC-like, i.e. users request credentials for a role that maps onto a conveyor (project - environment) combination. However, users should only be able to request roles of projects and environments to which they can contribute. It is not easy to impose this restriction unless the credentials would be handed out by conveyor, since conveyor knows which users have access to which project and environment, and can be configured to get access to corresponding IAM roles.

Are you currently working around this issue?
We have a relatively complex AWS set-up with Azure AD as IDP. Currently we use the aws-azure-login CLI tool to log in, then change role to get local credentials. However, in this way we can not restrict which roles can be assumed by which users. We can configure the roles such that only conveyor can assume them, but then we no longer have local access.

Our current workaround is to simply create users for each role with identical permissions and then use the long-lived acces and secret key. However this is potentially insecure as we will have to manually distribute credentials.

Additional context
It would be ideal if the ability to request local credentials is configurable on environment and/or project level. For example, we may not want people to be able to request local credentials for production, even if they are able to deploy there.

Attachments