mirrors/prometheus
1
0
Fork 0
mirror of https://github.com/prometheus/prometheus.git synced 2026-05-04 20:06:12 +02:00
Code Issues Projects Releases Wiki Activity

[ENHANCEMENT] AWS SD: Add optional external_id field

Browse Source 
AWS recommends that roles use an external ID to avoid accidentally granting access to the wrong account.

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
This commit is contained in:
Bryan Boreham 2025-09-10 11:48:24 +01:00
parent d7e9a2ffb0
commit 815ebe50f6
3 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
discovery/aws/ec2.go
View File

@ -93,6 +93,7 @@ type EC2SDConfig struct {
SecretKey config.Secret `yaml:"secret_key,omitempty"`
Profile string `yaml:"profile,omitempty"`
RoleARN string `yaml:"role_arn,omitempty"`
ExternalID string `yaml:"external_id,omitempty"`
RefreshInterval model.Duration `yaml:"refresh_interval,omitempty"`
Port int `yaml:"port"`
Filters []*EC2Filter `yaml:"filters"`
@ -219,7 +220,11 @@ func (d *EC2Discovery) ec2Client(ctx context.Context) (ec2Client, error) {
// If the role ARN is set, assume the role to get credentials and set the credentials provider in the config.
if d.cfg.RoleARN != "" {
assumeProvider := stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), d.cfg.RoleARN)
assumeProvider := stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), d.cfg.RoleARN, func(o *stscreds.AssumeRoleOptions) {
if d.cfg.ExternalID != "" {
o.ExternalID = aws.String(d.cfg.ExternalID)
}
})
cfg.Credentials = aws.NewCredentialsCache(assumeProvider)
}

7
discovery/aws/lightsail.go
View File

@ -76,6 +76,7 @@ type LightsailSDConfig struct {
SecretKey config.Secret `yaml:"secret_key,omitempty"`
Profile string `yaml:"profile,omitempty"`
RoleARN string `yaml:"role_arn,omitempty"`
ExternalID string `yaml:"external_id,omitempty"`
RefreshInterval model.Duration `yaml:"refresh_interval,omitempty"`
Port int `yaml:"port"`
@ -183,7 +184,11 @@ func (d *LightsailDiscovery) lightsailClient(ctx context.Context) (*lightsail.Cl
// If the role ARN is set, assume the role to get credentials and set the credentials provider in the config.
if d.cfg.RoleARN != "" {
assumeProvider := stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), d.cfg.RoleARN)
assumeProvider := stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), d.cfg.RoleARN, func(o *stscreds.AssumeRoleOptions) {
if d.cfg.ExternalID != "" {
o.ExternalID = aws.String(d.cfg.ExternalID)
}
})
cfg.Credentials = aws.NewCredentialsCache(assumeProvider)
}

6
docs/configuration/configuration.md
View File

@ -1208,6 +1208,9 @@ See below for the configuration options for EC2 discovery:
# AWS Role ARN, an alternative to using AWS API keys.
[ role_arn: <string> ]
# Optional External ID that can go along with role_arn.
[ external_id: <string> ]
# Refresh interval to re-read the instance list.
[ refresh_interval: <duration> | default = 60s ]
@ -2068,6 +2071,9 @@ See below for the configuration options for Lightsail discovery:
# AWS Role ARN, an alternative to using AWS API keys.
[ role_arn: <string> ]
# Optional External ID that can go along with role_arn.
[ external_id: <string> ]
# Refresh interval to re-read the instance list.
[ refresh_interval: <duration> | default = 60s ]