Allow hosts to inject AWS STS clients - #47
Conversation
Keep Baton EKS defaults unchanged while letting hosts inject their credential-resolution and STS implementations for every role hop. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| config *config.Eks | ||
| awsConfig awsSdk.Config | ||
| baseClient *http.Client | ||
| loadAWSConfig AWSConfigLoader |
There was a problem hiding this comment.
🟡 Suggestion: Connector.loadAWSConfig is assigned at line 146 but never read anywhere else — the loader is only used locally inside New via opts.loadAWSConfig. Unlike newSTSClient (used in getCallingConfig), this field is dead state. Consider dropping it from the struct, or wiring it into the paths that build configs later so injected loaders actually apply post-construction.
| opts := options{ | ||
| loadAWSConfig: awsConfig.LoadDefaultConfig, | ||
| newSTSClient: func(cfg awsSdk.Config) stscreds.AssumeRoleAPIClient { | ||
| return sts.NewFromConfig(cfg) | ||
| }, | ||
| } | ||
| for _, fn := range optFns { | ||
| if fn != nil { | ||
| fn(&opts) | ||
| } | ||
| } | ||
| if opts.loadAWSConfig == nil || opts.newSTSClient == nil { | ||
| return nil, fmt.Errorf("eks connector: AWS config loader and STS client factory are required") | ||
| } |
There was a problem hiding this comment.
🟡 Suggestion: The PR adds new exported API (Option, AWSConfigLoader, STSClientFactory, WithAWSConfigLoader, WithSTSClientFactory) whose entire purpose is host-side injection, but no test exercises it. pkg/connector already has table-driven tests; a small test that passes a fake loader/STS factory into New would lock in the defaults-unchanged guarantee and the nil-option rejection at line 119.
Connector PR Review: Allow hosts to inject AWS STS clientsBlocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0 Review SummaryScanned the full PR diff for security and correctness. The change is confined to Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agents |
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
1 participant
Summary
Add optional constructor hooks for the AWS SDK config loader and STS client factory. Baton EKS defaults remain unchanged. A host can now apply its shared STS policy to the connector's base, binding-account, customer-account, and on-prem role assumptions.
Test
go test ./pkg/connector