csaccess 0.3.0

Overview

csaccess simplifies access to CONTACT cloud resources by providing a streamlined authentication flow with support for both interactive user-based and automated service-based authentication methods.

Installation

pip install csaccess

Setup and Configuration

Configuration

• The “relying party” local server requires port 29398 to be free and available

• The default user OIDC flow is interactive (browser login) and does not require a client secret.

• CS_AWS_OIDC_CLIENT_SECRET is only used in static OIDC mode (--static-oidc, client credentials grant):

• The --gitlab-oidc mode is intended for GitLab CI: it reads the GitLab-issued OIDC JWT from the CS_GITLAB_JWT environment variable and passes it directly to AWS STS as a web identity token. No client secret is involved.

• --static-oidc and --gitlab-oidc are mutually exclusive.

• The programmatic API takes no mode flags: the auth mode is derived from the secrets passed (gitlab_oidc_secret, static_oidc_secret) or found in the environment (CS_GITLAB_JWT, CS_AWS_OIDC_CLIENT_SECRET), in that order of precedence. The console parameters take precedence. Without any secret the interactive user flow is used.

On Linux / macOS:

export CS_AWS_OIDC_CLIENT_SECRET="<OIDC-client-secret>"

Windows CMD:

set CS_AWS_OIDC_CLIENT_SECRET="<OIDC-client-secret>"

Windows PowerShell:

$env:CS_AWS_OIDC_CLIENT_SECRET = "<OIDC-client-secret>"

For GitLab CI, use --gitlab-oidc. GitLab populates CS_GITLAB_JWT automatically via the id_tokens keyword. The --aws-role-arn must point to a role whose trust policy federates the GitLab OIDC provider (the default role trusts Keycloak and will not accept a GitLab JWT):

# .gitlab-ci.yml
get-token:
  id_tokens:
    CS_GITLAB_JWT:
      aud: <configured-audience>
  script:
    - python -m csaccess ca-auth-token --gitlab-oidc --aws-role-arn <gitlab-trusting-role-arn>

Usage Examples

Important: unset AWS specific vars existing in local env as they will interfere with AWS STS functionality.

unset AWS_PROFILE
unset AWS_DEFAULT_PROFILE

import csaccess
ca_pypi_url = csaccess.get_ca_pypi_url_programmatic()

ca_auth_token = csaccess.get_ca_auth_token_programmatic()
ecr_auth_token = csaccess.get_ecr_auth_token_programmatic()

csaccess.get_ca_auth_token_programmatic(static_oidc_secret="<OIDC-client-secret>")
csaccess.get_ca_auth_token_programmatic(gitlab_oidc_secret="<GitLab-CI-JWT>", aws_role_arn="<gitlab-trusting-role-arn>")

python -m csaccess

python -m csaccess ca-auth-token

python -m csaccess ecr-auth-token

Integration Examples

Following are examples for Linux / macOS:

CA_PYPI_URL=$(python -m csaccess --quiet)
pip install -i "${CA_PYPI_URL}/16.0/simple" cs.platform

ECR_TOKEN=$(python -m csaccess ecr-auth-token --quiet)
echo $ECR_TOKEN | base64 -d | cut -d: -f2 | docker login --username AWS --password-stdin <ECR-registry-url>