From 9b2dec01bdb1dc1012ffc1a6e913adca46c082bb Mon Sep 17 00:00:00 2001
From: Julian Wreford <julian.wreford@gearset.com>
Date: Wed, 15 May 2024 14:36:18 +0100
Subject: [PATCH 1/4] Reference AWSSDK.SecurityToken in the S3 Storage project
 so that authentication via Open ID connect is possible It is enough for the
 project to be referenced for this to work, and there is no reference to it in
 the code base, because it's existence allows the AWS SDK to work

---
 Directory.Packages.props                  | 1 +
 eng/dependabot/independent/Packages.props | 1 +
 eng/dependabot/independent/Versions.props | 1 +
 src/Extensions/S3Storage/S3Storage.csproj | 3 ++-
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 265fb7bef1d..bba240e506a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,6 +1,7 @@
 <Project>
   <ItemGroup>
     <PackageVersion Include="AWSSDK.S3" Version="$(AwsSdkS3Version)" />
+    <PackageVersion Include="AWSSDK.SecurityToken" Version="$(AwsSdkSecurityTokenVersion)" />
     <PackageVersion Include="Azure.Identity" Version="$(AzureIdentityVersion)" />
     <PackageVersion Include="Azure.Storage.Blobs" Version="$(AzureStorageBlobsVersion)" />
     <PackageVersion Include="Azure.Storage.Queues" Version="$(AzureStorageQueuesVersion)" />
diff --git a/eng/dependabot/independent/Packages.props b/eng/dependabot/independent/Packages.props
index e9ae84fb19b..4c3dc153ad5 100644
--- a/eng/dependabot/independent/Packages.props
+++ b/eng/dependabot/independent/Packages.props
@@ -19,5 +19,6 @@
     <PackageReference Include="Swashbuckle.AspNetCore" Version="$(SwashbuckleAspNetCoreVersion)" />
     <PackageReference Include="Moq" Version="$(MoqVersion)" />
     <PackageReference Include="AWSSDK.S3" Version="$(AwsSdkS3Version)" />
+    <PackageReference Include="AWSSDK.SecurityToken" Version="$(AwsSdkSecurityTokenVersion)" />
   </ItemGroup>
 </Project>
diff --git a/eng/dependabot/independent/Versions.props b/eng/dependabot/independent/Versions.props
index b4730147c38..9336ee3a92b 100644
--- a/eng/dependabot/independent/Versions.props
+++ b/eng/dependabot/independent/Versions.props
@@ -15,6 +15,7 @@
     <NJsonSchemaVersion>11.0.0</NJsonSchemaVersion>
     <SwashbuckleAspNetCoreVersion>6.5.0</SwashbuckleAspNetCoreVersion>
     <AwsSdkS3Version>3.7.305.7</AwsSdkS3Version>
+    <AwsSdkSecurityTokenVersion>3.7.300.33</AwsSdkSecurityTokenVersion>
 
     <!--
       Moq version & constants derived from Moq.
diff --git a/src/Extensions/S3Storage/S3Storage.csproj b/src/Extensions/S3Storage/S3Storage.csproj
index d002c596239..ae285f1badc 100644
--- a/src/Extensions/S3Storage/S3Storage.csproj
+++ b/src/Extensions/S3Storage/S3Storage.csproj
@@ -11,12 +11,13 @@
 
   <ItemGroup>
     <PackageReference Include="AWSSDK.S3" />
+    <PackageReference Include="AWSSDK.SecurityToken" />
   </ItemGroup>
 
   <ItemGroup>
     <ProjectReference Include="..\..\Microsoft.Diagnostics.Monitoring.Extension.Common\Microsoft.Diagnostics.Monitoring.Extension.Common.csproj" />
   </ItemGroup>
-  
+
   <ItemGroup>
     <Compile Update="OptionsDisplayStrings.Designer.cs">
       <DependentUpon>OptionsDisplayStrings.resx</DependentUpon>

From e520bd9180fcf4f4238fd3aef7228899cc80d246 Mon Sep 17 00:00:00 2001
From: Julian Wreford <julian.wreford@gearset.com>
Date: Wed, 15 May 2024 15:27:48 +0100
Subject: [PATCH 2/4] Documentation: add docs to cover the use of service
 accounts for S3

---
 documentation/configuration/egress-configuration.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/documentation/configuration/egress-configuration.md b/documentation/configuration/egress-configuration.md
index 9a8f08e089c..1b1490a5bcb 100644
--- a/documentation/configuration/egress-configuration.md
+++ b/documentation/configuration/egress-configuration.md
@@ -198,6 +198,14 @@ The Queue Message's payload will be the blob name (`<BlobPrefix>/<ArtifactName>`
  ```
 </details>
 
+### Authenticating to S3 using service accounts
+If running workloads in kubernetes it is common to authenticate with AWS via kubernetes service accounts ([AWS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html)). This is supported in dotnet monitor if none of: `accessKeyId`, `secretAccessKey`, `awsProfileName` are specified. In this case dotnet monitor will fallback to load credentials to login using AWS default defined environment variables, this means that workloads running in EKS can utilise service accounts as discussed in the above AWS documentation.
+
+Specifically the use of service accounts set the following environment variables which are detected by AWS SDK and used for authentication as a fallback:
+ - AWS_REGION
+ - AWS_ROLE_ARN
+ - AWS_WEB_IDENTITY_TOKEN_FILE
+
 ## Filesystem egress provider
 
 | Name | Type | Description |

From da1283a6c58977e8eb5846ad5e9d8cb9c872f901 Mon Sep 17 00:00:00 2001
From: Julian Wreford <91067643+jwreford99@users.noreply.github.com>
Date: Thu, 16 May 2024 08:53:11 +0100
Subject: [PATCH 3/4] Update documentation in line with spell checker

Spell checker flagged that Kubernetes should have an uppercase K and to use the American spelling of utilize

Co-authored-by: Justin Anderson <jander-msft@users.noreply.github.com>
---
 documentation/configuration/egress-configuration.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/documentation/configuration/egress-configuration.md b/documentation/configuration/egress-configuration.md
index 1b1490a5bcb..a457175bfe9 100644
--- a/documentation/configuration/egress-configuration.md
+++ b/documentation/configuration/egress-configuration.md
@@ -199,7 +199,7 @@ The Queue Message's payload will be the blob name (`<BlobPrefix>/<ArtifactName>`
 </details>
 
 ### Authenticating to S3 using service accounts
-If running workloads in kubernetes it is common to authenticate with AWS via kubernetes service accounts ([AWS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html)). This is supported in dotnet monitor if none of: `accessKeyId`, `secretAccessKey`, `awsProfileName` are specified. In this case dotnet monitor will fallback to load credentials to login using AWS default defined environment variables, this means that workloads running in EKS can utilise service accounts as discussed in the above AWS documentation.
+If running workloads in Kubernetes it is common to authenticate with AWS via Kubernetes service accounts ([AWS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html)). This is supported in dotnet monitor if none of: `accessKeyId`, `secretAccessKey`, `awsProfileName` are specified. In this case dotnet monitor will fallback to load credentials to login using AWS default defined environment variables, this means that workloads running in EKS can utilize service accounts as discussed in the above AWS documentation.
 
 Specifically the use of service accounts set the following environment variables which are detected by AWS SDK and used for authentication as a fallback:
  - AWS_REGION

From c3c0a5fc247f03286d40cdc11e72a77c9e9d9992 Mon Sep 17 00:00:00 2001
From: Julian Wreford <julian.wreford@gearset.com>
Date: Thu, 16 May 2024 08:55:05 +0100
Subject: [PATCH 4/4] PR Feedback: Add AWSSDK.SecurityToken.dll to the
 Signing.props file

---
 eng/Signing.props | 1 +
 1 file changed, 1 insertion(+)

diff --git a/eng/Signing.props b/eng/Signing.props
index 3bbc8889cff..47fa59d2ac1 100644
--- a/eng/Signing.props
+++ b/eng/Signing.props
@@ -2,6 +2,7 @@
   <ItemGroup>
     <FileSignInfo Include="AWSSDK.Core.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="AWSSDK.S3.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="AWSSDK.SecurityToken.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Newtonsoft.Json.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Newtonsoft.Json.Bson.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Swashbuckle.AspNetCore.Swagger.dll" CertificateName="3PartySHA2" />