feat: implement IAM authentication with assumeRoleWithWebIdentityCredentialProvider

README.md

@@ -99,3 +99,7 @@ This plugin can use the AWS Rekognition service to detect faces in an image and
 :warning: ️Using this will incur extra cost for each upload
 
 :warning: ️Using this requires the <code>rekognition:DetectFaces</code> action to be allowed.
+
+### Assuming Role with OIDC
+
+This plugin also has the ability to assume a role provided to the runtime with the `AWS_WEB_IDENTITY_TOKEN_FILE` and `AWS_ROLE_ARN` environment variables. If you provide no credentials to AWS and these environment variables exist, then the plugin will attempt to create a connection to AWS using the `CredentialProvider::assumeRoleWithWebIdentityCredentialProvider`. This is the ideal way to allow fine-grained access control for hosting CraftCMS in Kubernetes (for example). See [the IAM documentation on AWS for more details](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html).

src/Volume.php

@@ -10,6 +10,7 @@
 use Aws\CloudFront\CloudFrontClient;
 use Aws\CloudFront\Exception\CloudFrontException;
 use Aws\Credentials\Credentials;
+use Aws\Credentials\CredentialProvider;
 use Aws\Handler\GuzzleV6\GuzzleHandler;
 use Aws\Rekognition\RekognitionClient;
 use Aws\S3\Exception\S3Exception;
@@ -299,6 +300,18 @@ protected static function client(array $config = [], array $credentials = []): S
                 return call_user_func_array(self::class . '::buildConfigArray', $args);
             };
         }
+        else if (!empty(Craft::parseEnv("AWS_WEB_IDENTITY_TOKEN_FILE")) && !empty(Craft::parseEnv("AWS_ROLE_ARN"))) {
+            // Our instance/pod/task has a web identity configured, so we should use that
+            // Pretty much just lifted this from: https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials_provider.html#assume-role-with-web-identity-provider
+            $provider = CredentialProvider::assumeRoleWithWebIdentityCredentialProvider();
+            $provider = CredentialProvider::memoize($provider);
+            // Probably not the idiomatic approach relative to existing codebase, but we can just return the config array
+            $config = [
+                'region' => $credentials['region'],
+                'version' => 'latest',
+                'credentials' => $provider
+            ];
+        }
 
         return new S3Client($config);
     }