feat(assumeWebIdentityRole): support AssumeRoleWithWebIdentity arn swap

[jessesanford]

Description of your changes

Fixes #597

Specifically handles the usecase described by @benagricola here: #597 (comment)

With assumeWebIdentityRole set and assumeRoles unset:

The role ARN in assumeWebIdentityRole is assumed using the injected OIDC token from AWS_WEB_IDENTITY_TOKEN_FILE - the role name in AWS_ROLE_ARN is ignored.
At this point, we're targeting whatever account the role in assumeWebIdentityRole was in. This requires the target role to be trusting the current OIDC provider.
This allows us to assume a role via web identity in any number of AWS accounts (each a separate ProviderConfig).

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable test to ensure this PR is ready for review.

How has this code been tested

Unit tests created for supporting functions in pkg/clients/aws.go
Manual tests to be performed.

[haarchri]

Hey @jessesanford thanks for enhancement - we using GO SDK v1 for code-gen resources and GO SDK v2 for some manual/handmade resources can you check If both working ? Example UsePodServiceAccountV1 and UsePodServiceAccount

[jessesanford]

@haarchri

Hey @jessesanford thanks for enhancement - we using GO SDK v1 for code-gen resources and GO SDK v2 for some manual/handmade resources can you check If both working ? Example UsePodServiceAccountV1 and UsePodServiceAccount

I was wondering about the V1 suffixed functions. I can create a UsePodServiceAccountV1AssumeRoleWithWebIdentity I believe that is all that is required right? The other supporting functions don't get invoked directly right?

Do you have different build targets you use for the two different SDKS? or do you just need to know which resources to test with to flex the dfferent code paths?

[haarchri]

i will test tomorrow in our environment and will add final review

[jessesanford]

i will test tomorrow in our environment and will add final review

@stevendborrelli is also attempting to deploy a build of the provider from this branch to our POC environment so we can do some manual testing there as well. I don't have your test suite though, so don't let our work preclude yours @haarchri. TY!

[jessesanford]

i will test tomorrow in our environment and will add final review

Any chance you have been able to kick the tires?

[jessesanford]

i will test tomorrow in our environment and will add final review

We were able to get s3 bucket resources working:

$ k -n upbound-system get buckets.s3.aws.crossplane.io                             
NAME                       READY   SYNCED   AGE
crossplane-demo-xppocca1   True    True     132m
crossplane-demo-xppocca2   True    True     133m
crossplane-demo-xppoccpn   True    True     126m

$ k -n upbound-system get providerconfigs.aws.crossplane.io aws-provider-xppocca1 -o yaml                                       
apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration:
  creationTimestamp: "2022-04-14T20:50:00Z"
  finalizers:
  - in-use.crossplane.io
  generation: 2
  name: aws-provider-xppocca1
  resourceVersion: "269147"
  uid: 47000f10-dede-4436-b4cd-ea4d3003bdd5
spec:
  assumeRoleWithWebIdentity:
    roleARN: arn:aws:iam::111111111111:role/XXXXXXXXX
    roleSessionName: xppocca1
  credentials:
    source: InjectedIdentity
status:
  users: 1

$ k -n upbound-system get providerconfigs.aws.crossplane.io aws-provider-xppocca2 -o yaml                                       
apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration:
  creationTimestamp: "2022-04-14T20:50:09Z"
  finalizers:
  - in-use.crossplane.io
  generation: 2
  name: aws-provider-xppocca2
  resourceVersion: "269244"
  uid: 65bcde84-dbb9-4d9a-9f58-cb66690d68b0
spec:
  assumeRoleWithWebIdentity:
    roleARN: arn:aws:iam::222222222222:role/XXXXXXXXX
    roleSessionName: xppocca2
  credentials:
    source: InjectedIdentity
status:
  users: 1

$ k -n upbound-system get providerconfigs.aws.crossplane.io aws-provider-xppoccpn -o yaml
apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration:
  creationTimestamp: "2022-04-14T20:12:29Z"
  finalizers:
  - in-use.crossplane.io
  generation: 3
  name: aws-provider-xppoccpn
  resourceVersion: "269263"
  uid: 40c16b7c-d50a-423d-8902-b0b03901340b
spec:
  assumeRoleWithWebIdentity:
    roleARN: arn:aws:iam::333333333333:role/XXXXX
    roleSessionName: xppoccpn
  credentials:
    source: InjectedIdentity
status:
  users: 1

[stevendborrelli]

Functionality looks good. We were able to test provisioning in 3 different ARNs: the control plane's ARN and two other ones.

[haarchri]

tested the assumeRoleWithWebidentity in our environment (50 Accounts +)
@jessesanford @nabuskey @stevendborrelli thanks for implementation, testing and documentation

providerconfigs

apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: account-a
spec:
  credentials:
    source: InjectedIdentity

apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: account-b
spec:
  assumeRoleWithWebIdentity:
    roleARN: arn:aws:iam::111111111111:role/crossplane_deploy
    roleSessionName: b-from-a
  credentials:
    source: InjectedIdentity

apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: account-c
spec:
  assumeRoleWithWebIdentity:
    roleARN: arn:aws:iam::222222222222:role/crossplane_deploy
    roleSessionName: c-from-a
  credentials:
    source: InjectedIdentity

go sdk-v2

kubectl get buckets.s3.aws.crossplane.io                             
NAME                       	READY   SYNCED   AGE
bucket-account-a		True    True     10m
bucket-account-b		True    True     11m
bucket-account-c		True    True     12m

go sdk-v1

kubectl get filesystems.efs.aws.crossplane.io     
NAME                       	READY   SYNCED   AGE
filesystem-account-a		True    True     3m
filesystem-account-b		True    True     3m
filesystem-account-c		True    True     2m