Updating AWS SDK to support assuming an IAM role via an OIDC web identity token file

[matthewoflynn]

This change is to resolve: #18

Apologies for any blunders in advance, I'm not a Go developer. I've updated both the aws-sdk-go and go versions to the latest versions and have run the tests.

Output

> go test -timeout 5s -race -v ./...
?   	github.com/scribd/objinsync	[no test files]
=== RUN   TestWalkAndDeleteEmptyDir
--- PASS: TestWalkAndDeleteEmptyDir (0.00s)
=== RUN   TestWalkAndExcludeDir
--- PASS: TestWalkAndExcludeDir (0.00s)
=== RUN   TestWalkAndExcludeNestedDirs
--- PASS: TestWalkAndExcludeNestedDirs (0.00s)
=== RUN   TestWalkAndExcludeFile
--- PASS: TestWalkAndExcludeFile (0.00s)
=== RUN   TestSkipParentDir
--- PASS: TestSkipParentDir (0.00s)
=== RUN   TestDeleteStaleFile
--- PASS: TestDeleteStaleFile (0.00s)
=== RUN   TestSkipObjectsWithoutChange
--- PASS: TestSkipObjectsWithoutChange (0.00s)
=== RUN   TestSkipExcludedObjects
--- PASS: TestSkipExcludedObjects (0.00s)
=== RUN   TestSkipDirectories
--- PASS: TestSkipDirectories (0.00s)
=== RUN   TestNestedPathDownload
--- PASS: TestNestedPathDownload (0.00s)
PASS
ok  	github.com/scribd/objinsync/pkg/sync	0.612s

Further Testing

I've deployed a Docker image with this change to an EKS cluster and verified that the correct IAM role is being picked up.

ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: airflow
  annotations:
    "eks.amazonaws.com/role-arn": "arn:aws:iam::<---role--->"

Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: basic-deployment
  labels:
    app: simple
spec:
  replicas: 1
  selector:
    matchLabels:
      app: simple
  template:
    metadata:
      labels:
        app: simple
    spec:
      serviceAccountName: airflow
      securityContext:
        # objinsync runs with a non-root user and when running a container with
        # a non-root user, you need to give the container access to the token 
        # file by setting the fsGroup field in the securityContext object.
        #
        # Ref: https://github.com/aws/amazon-eks-pod-identity-webhook#usage-with-non-root-container-user
        fsGroup: 1000
      containers:
      - name: objinsync
        image: <private-docker-container-registry>/objinsync:latest
        command: ["objinsync"]
        args: ["pull", "--interval", "10s", "s3://example-bucket/", "/tmp"]

[houqp]

Thank you @matthewoflynn for the upgrade!