imbi-plugin-aws

AWS provider for the Imbi project logs and configuration tabs.

Plugins shipped

This package ships (or will ship) three entry points from one distribution:

Slug Type Status
aws-iam-ic identity ✅ shipped
aws-ssm configuration planned
aws-cloudwatch-logs logs planned

The identity plugin federates each Imbi user into AWS via IAM Identity Center (formerly AWS SSO) and mints short-lived STS credentials per call. The data plugins (when shipped) consume those credentials transparently — see the contract below.

Identity consumption contract for the data plugins

When a project's (:Project)-[:USES_PLUGIN]->(:Plugin) edge or project-type fallback names this package's aws-iam-ic plugin via the identity_plugin_id edge property, the host-side hydrate_identity() helper runs aws-iam-ic.materialize() before calling the data plugin's handler. materialize() calls GetRoleCredentials against the IAM IC Portal API and returns short-lived STS keys in IdentityCredentials.extra:

IdentityCredentials(
    access_token=<unchanged IAM IC token>,
    extra={
        'aws_access_key_id':     'AKIA...',
        'aws_secret_access_key': '...',
        'aws_session_token':     '...',
        'aws_region':            'us-east-1',
        'aws_account_id':        '111111111111',
    },
)

The host attaches this to PluginContext.identity and the data plugins read it from there. Concretely, when aws-ssm (or aws-cloudwatch-logs) is invoked:

async def list_keys(self, ctx, credentials):
    if ctx.identity is not None:
        # IAM IC path: credentials dict is empty (no operator-supplied
        # static keys); read STS from ctx.identity.extra.
        aws_creds = ctx.identity.extra
    else:
        # Static-key path: ServiceApplication.plugin_credentials carries
        # access_key_id / secret_access_key / session_token.
        aws_creds = credentials
    session = aiobotocore.session.get_session()
    client = session.create_client(
        'ssm',
        region_name=aws_creds['aws_region'],
        aws_access_key_id=aws_creds['aws_access_key_id'],
        aws_secret_access_key=aws_creds['aws_secret_access_key'],
        aws_session_token=aws_creds.get('aws_session_token'),
    )
    ...

The data plugin doesn't know whether the caller is federated (via aws-iam-ic) or running as a service principal (legacy ServiceApplication.plugin_credentials). Same five well-known keys, sourced differently.

requires_identity=true on a future logs/configuration manifest would make the federated path mandatory; today both plugins fall back to the service-principal credentials when no ctx.identity is set.

License

BSD-3-Clause.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.23.0)

Owner

PyPI data
Data sourced directly from PyPI's database.

Credits

Author: Gavin M. Roy

License

BSD-3-Clause

Requires

Python >=3.14

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

imbi_plugin_aws-2.11.6.tar.gz (153.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

imbi_plugin_aws-2.11.6-py3-none-any.whl (36.8 kB view details)

Uploaded Python 3

File details

Details for the file imbi_plugin_aws-2.11.6.tar.gz.

File metadata

  • Download URL: imbi_plugin_aws-2.11.6.tar.gz
  • Upload date:
  • Size: 153.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for imbi_plugin_aws-2.11.6.tar.gz
Algorithm Hash digest
SHA256 170d3434abca20ddfb1da62b3422350da6d61ed7fb9f6649c301ae9d87b78db8
MD5 9464f490ff7671b2b4eccafe59b64e1a
BLAKE2b-256 707c21ad55e50ec0692250673a276356fcdd3ae31b0f68d249d42ab30394c3ea

See more details on using hashes here.

Provenance

The following attestation bundles were made for imbi_plugin_aws-2.11.6.tar.gz:

Publisher: publish.yml on AWeber-Imbi/imbi-plugin-aws

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file imbi_plugin_aws-2.11.6-py3-none-any.whl.

File metadata

File hashes

Hashes for imbi_plugin_aws-2.11.6-py3-none-any.whl
Algorithm Hash digest
SHA256 bd747398ff93960d912c1e52918145cdf7a1d7d0407be1795625109bb284ee77
MD5 5e56cc48735bdbbb3b343f85db2c2120
BLAKE2b-256 ab8214bb04b2f9c87461c6f554521edd826dcaad6932eb68d41abeec6c7ae8fc

See more details on using hashes here.

Provenance

The following attestation bundles were made for imbi_plugin_aws-2.11.6-py3-none-any.whl:

Publisher: publish.yml on AWeber-Imbi/imbi-plugin-aws

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page