Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: use aws-sdk to increase aws support in eks pods #262

Open
wants to merge 1 commit into
base: next
Choose a base branch
from

Conversation

amille44420
Copy link
Contributor

@amille44420 amille44420 commented Jan 21, 2022

Purpose

Allow the application to get credential from the AWS profile on the host. For our production environment the host being a container orchestrated by AWS EKS, we focus on using the ServiceAccount which may assume an AMI Role through OIDC.

By doing so, we will not be forced to provide access keys anymore and may improve our security standing.

Changes

  • Replace MinIO client by AWS SDK v3 to use AWS profile for credentials
  • Provide support for AWS SES transport which allow to use AWS profile for credentials
  • Add aws4 on additional dependencies when building for production, required to support passwordless authentication with Mongo Atlas & AWS IAM

@amille44420 amille44420 added the enhancement New feature or request label Jan 21, 2022
@amille44420 amille44420 requested a review from a team January 21, 2022 02:36
@amille44420 amille44420 self-assigned this Jan 21, 2022
@amille44420 amille44420 marked this pull request as ready for review August 18, 2022 10:42
@codecov
Copy link

codecov bot commented Aug 18, 2022

Codecov Report

Merging #262 (c6d55e0) into next (84c4adb) will increase coverage by 0.17%.
The diff coverage is 41.89%.

@@            Coverage Diff             @@
##             next     #262      +/-   ##
==========================================
+ Coverage   36.10%   36.28%   +0.17%     
==========================================
  Files         185      186       +1     
  Lines        2703     2737      +34     
  Branches      496      507      +11     
==========================================
+ Hits          976      993      +17     
- Misses       1722     1739      +17     
  Partials        5        5              
Flag Coverage Δ
component 34.87% <56.52%> (+0.07%) ⬆️
e2e 100.00% <ø> (ø)
unit 24.91% <41.89%> (+0.31%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
src/server/utils/streamToBuffer.ts 0.00% <0.00%> (ø)
src/__tests__/helpers/storage.ts 33.33% <20.00%> (+16.66%) ⬆️
src/server/core/storage.ts 46.34% <48.48%> (+6.34%) ⬆️
src/server/emails/transporters.ts 54.54% <50.00%> (-45.46%) ⬇️
src/server/core/config.ts 62.50% <61.53%> (-8.09%) ⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@amille44420 amille44420 force-pushed the feat/aws branch 2 times, most recently from 141ccb6 to ee6b11e Compare August 19, 2022 02:18
When running in EKS pod with a ServeAccount trusted by an IAM role, the application can get credentials directly from the SA to call AWS API.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant