- Notifications
You must be signed in to change notification settings - Fork1k
docs: add guide for Google to AWS federation#11429
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Merged
Uh oh!
There was an error while loading.Please reload this page.
Merged
Changes fromall commits
Commits
Show all changes
2 commits Select commitHold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Uh oh!
There was an error while loading.Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading
Uh oh!
There was an error while loading.Please reload this page.
Diff view
Diff view
There are no files selected for viewing
184 changes: 184 additions & 0 deletionsdocs/guides/gcp-to-aws.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,184 @@ | ||
| # Federating a Google Cloud service account to AWS | ||
| This guide will walkthrough how to use a Google Cloud service account to | ||
| authenticate the Coder control plane to AWS and create an EC2 workspace. The | ||
| below steps assume your Coder control plane is running in Google Cloud and has | ||
| the relevant service account assigned. | ||
| > For steps on assigning a service account to a resource like Coder, | ||
| > [see the Google documentation here](https://cloud.google.com/iam/docs/attach-service-accounts#attaching-new-resource) | ||
| ## 1. Get your Google service account OAuth Client ID | ||
| > (Optional): If you do not yet have a service account, | ||
| > [here is the Google IAM documentation on creating a service account](https://cloud.google.com/iam/docs/service-accounts-create). | ||
| Navigate to the Google Cloud console, and select **IAM & Admin** > **Service | ||
| Accounts**. View the service account you want to use, and copy the **OAuth 2 | ||
| Client ID** value shown on the right-hand side of the row. | ||
| ## 1. Create AWS role | ||
| Create an AWS role that is configured for Web Identity Federation, with Google | ||
| as the identity provider, as shown below: | ||
|  | ||
| Once created, edit the **Trust Relationship** section to look like the | ||
| following: | ||
| ```json | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "Federated": "accounts.google.com" | ||
| }, | ||
| "Action": "sts:AssumeRoleWithWebIdentity", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "accounts.google.com:aud": "<enter-OAuth-client-ID-here" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ``` | ||
| ## 1. Assign permissions to the AWS role | ||
| In this example, Coder will need permissions to create the EC2 instance. Add the | ||
| following policy to the role: | ||
| ```json | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Sid": "VisualEditor0", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:GetDefaultCreditSpecification", | ||
| "ec2:DescribeIamInstanceProfileAssociations", | ||
| "ec2:DescribeTags", | ||
| "ec2:DescribeInstances", | ||
| "ec2:DescribeInstanceTypes", | ||
| "ec2:CreateTags", | ||
| "ec2:RunInstances", | ||
| "ec2:DescribeInstanceCreditSpecifications", | ||
| "ec2:DescribeImages", | ||
| "ec2:ModifyDefaultCreditSpecification", | ||
| "ec2:DescribeVolumes" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Sid": "CoderResources", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:DescribeInstanceAttribute", | ||
| "ec2:UnmonitorInstances", | ||
| "ec2:TerminateInstances", | ||
| "ec2:StartInstances", | ||
| "ec2:StopInstances", | ||
| "ec2:DeleteTags", | ||
| "ec2:MonitorInstances", | ||
| "ec2:CreateTags", | ||
| "ec2:RunInstances", | ||
| "ec2:ModifyInstanceAttribute", | ||
| "ec2:ModifyInstanceCreditSpecification" | ||
| ], | ||
| "Resource": "arn:aws:ec2:*:*:instance/*", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "aws:ResourceTag/Coder_Provisioned": "true" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| ``` | ||
| ## 1. Generate the identity token for the service account | ||
| Run the following `gcloud` command to generate the service account identity | ||
| token. This is a JWT token with a payload that includes the service account | ||
| email, audience, issuer, and expiration. | ||
| ```console | ||
| gcloud auth print-identity-token --audiences=https://aws.amazon.com --impersonate-service-account 12345-compute@de | ||
| veloper.gserviceaccount.com --include-email | ||
| ``` | ||
| > Note: Your `gcloud` client may needed elevated permissions to run this | ||
| > command. | ||
| ## 1. Set identity token in Coder control plane | ||
| You will need to set the token created in the previous step on a location in the | ||
| Coder control plane. Follow the below steps for your specific deployment type: | ||
| ### VM control plane | ||
| - Write the token to a file on the host, preferably inside the `/home/coder` | ||
| directory: | ||
| ```console | ||
| /home/coder/.aws/gcp-identity-token | ||
| ``` | ||
| ### Kubernetes control plane | ||
| - Create the Kubernetes secret to house the token value: | ||
| ```console | ||
| kubectl create secret generic gcp-identity-token -n coder --from-literal=token=<enter-token-here> | ||
| ``` | ||
| Make sure the secret is created inside the same namespace where Coder is | ||
| running. | ||
| - Mount the token file into the Coder pod using the values below: | ||
| ```yaml | ||
| volumes: | ||
| - name: "gcp-identity-mount" | ||
| secret: | ||
| secretName: "gcp-identity-token" | ||
| volumeMounts: | ||
| - name: "gcp-identity-mount" | ||
| mountPath: "/home/coder/.aws/gcp-identity-token" | ||
| readOnly: true | ||
| ``` | ||
| ## 1. Configure the AWS Terraform provider | ||
| Navigate to your EC2 workspace template in Coder, and configure the AWS provider | ||
| using the block below: | ||
| ```hcl | ||
| provider "aws" { | ||
| assume_role_with_web_identity { | ||
| # enter role ARN here - copy from AWS console | ||
| role_arn = "arn:aws:iam::123456789:role/gcp-to-aws" | ||
| # arbitrary value for logging | ||
| session_name = "coder-session" | ||
| # define location of token file on control plane here | ||
| web_identity_token_file = "/home/coder/.aws/gcp-identity-token" | ||
| } | ||
| } | ||
| ``` | ||
| This provider block is equivalent to running this `aws` CLI command: | ||
| ```console | ||
| aws sts assume-role-with-web-identity \ | ||
| --role-arn arn:aws:iam::123456789:role/gcp-to-aws \ | ||
| --role-session-name coder-session \ | ||
| --web-identity-token xxx | ||
| ``` | ||
| You can run this command with the identity token string to validate or | ||
| troubleshoot the call to AWS. |
Binary file addeddocs/images/guides/gcp-to-aws/aws-create-role.png
Loading
Sorry, something went wrong.Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
5 changes: 5 additions & 0 deletionsdocs/manifest.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.